Topic starter
26/08/2026 11:51 am
TL;DR: AI can accelerate secure development lifecycle review, but it still overstated severity in 46% of cases and missed a known WebAuthn flaw, according to Yubico’s experience using Claude Code and Codex Security across 29 repositories. The finding is not that AI is unreliable, but that it needs tight task boundaries, human triage, and governance around refusal handling and validation depth.
Editorial analysis by NHI Mgmt Group, based on content published by Yubico: “Beyond overload: Yubico’s measured approach to AI adoption”.
Key questions
Q: What breaks when AI documentation and triage tools are deployed without human review?
A: Without human review, AI can create inaccurate notes, miss clinical nuance, or route patients incorrectly.
Q: Why do security models struggle with compound vulnerability analysis?
A: Compound analysis requires the reviewer to understand how several weaker issues interact across code paths, state transitions, or trust boundaries.
Q: What are the signs that an AI security agent is failing governance review?
A: Common warning signs include unclear retry behaviour, no fixed scope boundaries, mixed operator intervention, and logs that cannot reconstruct each action.
Practitioner guidance
- Define authorised AI review scopes Restrict model prompts to clearly bounded review tasks, such as a single weakness class or a single repository slice, and document what the model is not expected to judge.
- Require human triage for severity changes Make every AI-generated High or Critical finding pass through manual verification before it can influence release decisions, risk reporting, or remediation priority.
- Add exploit-chain validation steps Test whether the review process can reason about how multiple lower-severity weaknesses combine into a material exploit path, especially in identity and authentication code.
Bottom line: AI-assisted code review can expand security coverage, but it does not remove the need for human judgment on severity, exploitability, or protocol-sensitive defects.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
26/08/2026 11:51 am
AI-assisted code review is becoming a governance problem, not just a productivity tool. Once models participate in security assessment, the organisation has to govern prompt scope, refusal handling, and evidence quality with the same discipline it applies to human review. The article shows that speed gains are real, but so is the risk of false confidence if AI output is treated as authoritative. The practical conclusion is that AI review needs operating controls, not just model access.
A few things that frame the scale:
- Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should teams use AI review for identity and authentication code?
A: Yes, but only as a support layer. Identity and authentication code often depends on trust assumptions, protocol sequence, and token handling that require human judgment to confirm. AI can broaden coverage and speed up first-pass analysis, but it should not be the final authority on WebAuthn, session, or authorisation defects.
👉 Read our full editorial: AI-assisted code security review raises both signal and governance questions