AI For Security Review In Application Code

A 2025 benchmark ran three industry static analysis tools (SonarQube, CodeQL, and Snyk Code) against sixty-three real vulnerabilities planted in ten real-world C# projects. The best of them, Snyk Code, finished with an F1 of about 0.55. The worst, SonarQube, landed at 0.26. Then the same researchers ran the same set through three frontier LLMs. GPT-4.1, Mistral Large, and DeepSeek V3 all landed between 0.75 and 0.80, mostly by catching things the static tools just walked past. If you read that...