AI AGENTS JUST TIPPED CODE SECURITY FROM NOISY TO USEFUL — MAINTAINERS REPORT A SURGE OF REAL BUGS
AI-driven agents are now producing high-quality vulnerability reports at scale, shifting security triage from AI slop to real issues. Multiple veteran maintain...
AI-driven agents are now producing high-quality vulnerability reports at scale, shifting security triage from AI slop to real issues.
Multiple veteran maintainers say the quality and volume of AI-generated security reports flipped in the last month. Linux kernel, cURL, and HAProxy maintainers report a daily flood of valid findings, with duplicate reports from different tools becoming common (Greg Kroah-Hartman, Daniel Stenberg, Willy Tarreau).
This lines up with broader takes that frontier-model agents are unusually strong at exploitation-style search and pattern matching across large codebases Vulnerability Research Is Cooked. On the research front, Meta reports agents that can verify code without running it, claiming 93% accuracy, hinting at practical static-style checks that scale DevOps.com coverage.
Triage load is rising fast, but so is the signal — real bugs are surfacing earlier and in bunches.
Security posture can shift left meaningfully if teams can harness agent output without drowning ops.
-
terminal
Run an agent pass on your top two services and compare precision against current SAST/linters; track true positives and triage time.
-
terminal
Pilot a gated CI job that asks an agent to produce minimal PoCs for high-severity findings to prioritize only reproducible issues.
Legacy codebase integration strategies...
- 01.
Integrate agent scans after SAST to reduce noise, require structured reports (file, sink, input, minimal PoC) to cut triage time.
- 02.
Update vuln intake: rate-limit external reports, dedupe by stack trace and code spans, and define SLAs for agent-sourced issues.
Fresh architecture paradigms...
- 01.
Design for scanability: clear module boundaries, sanitized input paths, and property-based tests that agents can extend.
- 02.
Bake continuous agent scanning into PRs with auto-opened issues only when a reproducible test is generated.