AI-assisted vulnerability discovery: what it means for security teams

TL;DR: A multi-agent AI security pipeline found 152 confirmed high or critical issues across 23 repositories, versus 17 from commercial SAST, with 70 findings emerging only from deep semantic analysis, according to Namirial. The result suggests AI-assisted review is now a complementary control for catching design flaws, exception handling failures and cross-file logic that pattern-based scanning cannot see.

Editorial analysis by NHI Mgmt Group, based on content published by Namirial: “Multi-agent AI security: how Namirial hardened its trust services in 28 days, using frontier AI models”.

By the numbers:

• The AI pipeline produced 152 candidate findings, of which 136 were confirmed by code owners and remediated.
• The commercial SAST identified 17 high or critical findings across the same perimeter.
• On 22 of 23 repositories, the AI pipeline identified more high or critical findings than the commercial SAST.

Key questions

Q: What should security teams do first when AI scanners produce more findings than analysts can triage?

A: Start by separating validated, exploitable findings from unverified output and route them into distinct queues.

Q: When does AI-assisted code review create more value than traditional scanning?

A: It creates the most value when the risk depends on intent, cross-file execution or security decisions hidden across modules.

Q: What are the signs that an AI security pipeline is not trustworthy enough for release gating?

A: High finding counts are not the problem by themselves.

Practitioner guidance

• Define which defect classes belong in AI review Separate logic flaws, trust boundary issues, cryptographic misuse and exception handling from the categories your SAST already covers well.
• Build a validation stage before human triage Require an independent challenge step that attempts to disprove each candidate finding before engineers spend time on it.
• Route findings into existing engineering workflows Automatically open issues from structured findings so review, ownership and remediation stay inside the normal delivery process.

Bottom line: Pattern-based scanning still misses logic-heavy and cross-file defects that require semantic reasoning to detect reliably.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →