01The three-tier model (Wiz)
Wiz describes AI SAST not as one model but as a context-aware multi-engine system. Tier 1: deterministic baseline scanning with signatures — fast, cheap, before every merge. Tier 2: continuous AI reasoning on every pull request that understands application structure, trust boundaries and data flows. Tier 3: targeted agentic pentesting for high-value applications only. Core thesis: “Deep scanning everywhere doesn't scale” — frontier analysis is expensive and point-in-time while code changes hourly.
02Triage: the best-evidenced benefit
The most mature use is not finding but sorting out. An LLM filter behind a deterministic scanner reduces false alarms consistently across several independent studies: QASecClaw 88.6 percent on the OWASP Benchmark at 3.1 percent recall loss, “Sifting the Noise” up to 93.3 percent on real CodeQL alerts, SAST-Genius around 91 percent (225 to 20 findings). This is exactly where the economic leverage lies, because alert fatigue is the most common reason SAST programmes fail.
03Semantic reasoning instead of patterns
In tier 2 the model first builds an understanding of the application, forms attack hypotheses and tests them across file and function boundaries — “like a security researcher”. The neuro-symbolic IRIS approach (LLM infers taint specs, CodeQL runs the analysis) found 55 instead of 27 vulnerabilities on CWE-Bench-Java versus CodeQL alone and uncovered four previously unknown ones. The context-rich CORRECT study shows repository context is the decisive lever — which is why whole-repo approaches beat pure snippet classification.
Fundamentals: classic SAST →04Autonomous vulnerability discovery
Discovery itself is becoming a commodity: Google Big Sleep reported twenty real zero-days in 2025 and prevented an attack for the first time (CVE-2025-6965). The DARPA AIxCC finalists autonomously found 86 percent of injected vulnerabilities in August 2025 at around 152 dollars per task. Wiz Atlas exceeds 90 percent on the CyberGym benchmark and 200+ unknown vulnerabilities. In 2026 even an open-weight model (Kimi K2.5), via a synthesised agent harness, found ten zero-days in Google Chrome.
Consulting: AI Code Security →05Coding agents as reviewers
The major coding assistants have security review built in: Anthropic's Claude Code Security Review (open source, MIT, diff-aware, actively filters FP-prone classes), GitHub Copilot Code Review (over 60M reviews, 71 percent with actionable feedback), OpenAI Codex Security (over 100,000 external PRs per day, deliberately precision over recall), Cursor Bugbot (8 parallel runs plus majority voting against non-determinism, 70+ percent resolution). All explicitly document hallucination risk and the duty to review.
06AI-native SAST vendors
Alongside the incumbents (Checkmarx, Veracode Fix, Snyk Agent Fix at 85 percent secure-and-functional rate, Sonar, GitLab Duo) a distinct class of AI-native tools has emerged: ZeroPath, Corgea, DryRun, Amplify, Almanax. An independent pentester test (Joshua Rogers, 09/2025) confirms their strength on logic and authorization flaws but measures wide ranges: Corgea around 80 percent detection at roughly 50 percent false alarms, others delivered mostly false alarms. Vendor benchmarks (‘100% detection’) deserve a counter-check.
07Limit 1 — non-determinism
LLM verdicts vary between runs, and fundamentally so: even at temperature 0 outputs are not reproducible because inference is not batch-invariant (Thinking Machines: 80 different results from 1,000 identical requests). For a compliance gate this means the reproducible baseline must come from tier 1; AI findings need an audit trail and human sampling, not blind automation. GitHub and GitLab write exactly this into their usage docs.
08Limit 2 — the analyst becomes a target
A model that reads repository content processes instructions in comments, READMEs and issues as input. That is exploitable: adversarial comments fool LLM detectors in over 90 percent of cases (ALIBI framework), and framing alone suppresses up to 97 percent of detected vulnerabilities. Real incidents range from CVE-2025-53773 (Copilot RCE via prompt injection) to an RCE on CodeRabbit's servers with write access to a million repositories. NIST lists indirect prompt injection as its own attack class.
09The honest reality check
Not every success story survives scrutiny. On truly unseen zero-days (ZeroDayBench, CVEs ported into foreign repositories) even frontier models still fail at autonomous finding and patching. Naive LLM classification without context sits at a balanced accuracy of 0.50 to 0.55 — barely above a coin flip. And benchmark contamination remains a caveat, even if it is not the main driver on the real vulnerability benchmarks. Hence: AI complements the layers, it does not replace them.
