The European Union Agency for Cybersecurity (ENISA) and CERT-EU have published a joint advisory examining how frontier artificial intelligence models can support security-focused source code review.
The November 2026 publication reports the results of an experiment conducted under the EU action plan on cybersecurity and artificial intelligence, using frontier AI models to review open-source software maintained by EU institutions, bodies, offices and agencies.
The central conclusion is clear: AI can accelerate vulnerability discovery and code review, but it cannot replace human judgement.
27 Codebases Analysed
ENISA analysed 27 codebases:
25 already open source;
2 expected to become open source.
The experiment focused exclusively on source code.
AI models were not given information about production deployments, and no live applications were tested.
220 Potential Security Issues Identified
Across the 27 codebases, the AI-assisted reviews identified 220 potential security issues, which were subsequently shared with the relevant code owners.
ENISA emphasises, however, that an AI-generated finding should not automatically be treated as a confirmed vulnerability.
Further expert assessment is necessary to determine whether a finding is real, relevant and accurately classified.
95% True-Positive Rate Among Reviewed Findings
At the time of publication, code owners had completed their assessment of 88 findings.
Of those, 95% were confirmed as true positives.
The remaining 5% were classified as false positives or not applicable, often because the AI tools lacked relevant information about the runtime environment.
The chart on page 10 of the advisory visually summarises this result, showing the very high proportion of confirmed findings alongside the smaller group of false or non-applicable outputs.
Four New CVE IDs Assigned
The experiment also resulted in four new Common Vulnerabilities and Exposures (CVE) identifiers being assigned.
This demonstrates that AI-assisted review was not limited to theoretical findings: some issues were sufficiently substantiated to progress through established vulnerability disclosure processes.
Frontier Models Used in the Experiment
ENISA reports that it was granted structured access to several frontier AI models with advanced cybersecurity capabilities.
These included:
OpenAI GPT-5.5 Cyber;
OpenAI GPT-5.6 Cyber;
OpenAI GPT-6 Astra;
Anthropic Mythos 5.
The advisory also lists the tools and harnesses used in the experiment, including OpenAI’s Codex client, the Codex Security plug-in, OpenCode, CERT-EU’s Vigilo and ENISA-developed skills.
CERT-EU’s Vigilo Harness
One of the central tools evaluated was Vigilo, an AI-powered penetration-testing pipeline developed by CERT-EU.
Rather than relying on a single AI agent, Vigilo orchestrates multiple specialised agents that share information through a common knowledge base.
Individual agents can focus on areas such as:
injection;
authentication;
authorisation;
cryptography;
supply-chain vulnerabilities.
Adversarial Review of Findings
Vigilo includes an adversarial critique stage that re-examines each finding.
This process challenges severity assessments, merges duplicate findings and attempts to ensure that the final report contains only issues considered sufficiently substantiated.
Where source code is available, Vigilo can also generate a proposed patch on a separate branch for maintainers to review.
ENISA Developed Dedicated AI Skills
ENISA also developed specific agentic skills to support the experiment.
The Code Auditor skill guides an AI agent through a structured, multi-phase security review and instructs it to record evidence supporting each finding.
The Findings Browser Report converts raw audit results into a structured, interactive HTML report.
Secure, Isolated Testing Environment
A major operational recommendation from ENISA is that AI-assisted code review should take place in a secure, isolated environment.
The experiment used a sandboxed environment designed to prevent AI models from accessing systems, data or services outside the intended test scope.
The diagram on page 8 shows this architecture, with AI clients, plug-ins, skills, reporting templates and analytics scripts operating inside a container separated from the host system.
Why Isolation Matters
ENISA notes that modern AI security tools can potentially:
read repositories;
create files;
execute commands;
install dependencies;
call remote services.
Organisations should therefore implement controls such as:
network segmentation;
access control;
clearly defined trust boundaries;
monitoring.
Production Context Is Critical
One of the most important lessons from the experiment is that source code alone may not provide enough context to determine the real severity of a vulnerability.
AI tools may not know:
what components are externally reachable;
what privileges are available;
which systems are trusted;
what external controls exist;
what risks have already been accepted.
Without this context, AI may overestimate or underestimate the practical severity of a finding.
AI Tended to Overrate Severity
After human review, ENISA observed a slight tendency for AI systems to overrate vulnerability severity.
The difference between the original AI classification and the final human assessment reinforces the importance of expert review.
Final Human Severity Distribution
Among findings evaluated by code owners, the final severity distribution was:
26% high;
34% medium;
29% low;
11% informational.
This differed from the original AI-generated classifications and demonstrates why automated severity labels should not be accepted without validation.
Specialised Harness Produced More Accurate Severity Ratings
The experiment compared general-purpose coding agents with security skills or plug-ins against the specialised Vigilo security harness.
Code owners retained the original severity assigned by:
Vigilo in 74% of cases;
general-purpose coding agents in 60% of cases.
This suggests that Vigilo’s additional validation steps produced severity assessments closer to those of the human reviewers.
General-Purpose Agents Were Faster and Cheaper
There was, however, a trade-off.
General-purpose coding agents with security capabilities were generally:
faster;
less expensive.
Vigilo required more time and cost because it performed additional steps such as adversarial validation and patch generation.
Approximately €6,649 in Estimated Scan Costs
ENISA estimates that the total cost of all code scans would have been approximately €6,648.90.
The estimated average cost was around €132.27 per 10,000 lines of code.
The report stresses that these figures are indicative because ENISA received access to the frontier AI models free of charge under provider access programmes.
More Than 611 Million Tokens Used
The experiment consumed approximately 611,486,042 tokens across the reviewed codebases.
This illustrates the potentially significant computational and operational resources required for large-scale AI-assisted security review.
AI Can Accelerate Vulnerability Research
ENISA concludes that frontier AI models can significantly accelerate vulnerability research.
They can also assist security analysts in developing proof-of-concept exploits in controlled environments to determine whether suspected vulnerabilities can actually be reproduced.
Coordinated Vulnerability Disclosure Remains Essential
Findings should always be reported through the appropriate Coordinated Vulnerability Disclosure (CVD) channel.
For EU institutions, this means coordination through CERT-EU.
For community-maintained open-source projects, disclosure should follow each project’s established policy.
ENISA warns that bypassing established disclosure channels could expose users if vulnerabilities become public before fixes are available.
Humans Must Remain in the Loop
The advisory strongly reinforces the need for human oversight on both sides of the vulnerability disclosure process.
Researchers should:
deduplicate findings;
verify findings where possible;
provide appropriate context before reporting.
Code owners need sufficient expertise, time and resources to assess the findings properly.
AI Changes the Economics of Vulnerability Discovery
ENISA and CERT-EU conclude that AI is changing the economics of vulnerability discovery.
Weaknesses can now be identified faster and at lower cost, but defenders still have to:
validate the findings;
prioritise them;
reproduce them;
fix them correctly.
This creates a potential imbalance between the speed of vulnerability discovery and the capacity of human teams to respond.
Expert Capacity Could Become the Bottleneck
The report warns that skilled cybersecurity experts are already scarce.
As AI produces larger numbers of findings, the ability of experts to validate and prioritise those findings could become an increasingly serious constraint.
Future tooling may therefore need to focus not only on finding more vulnerabilities but also on:
triaging results;
consolidating duplicates;
reducing false positives;
prioritising high-risk findings before human review.
Fully Automated Patching Is Not Recommended
The advisory cautions against fully automated remediation.
Human review remains necessary because automatically generated patches may:
introduce new defects;
fail to address the root cause;
create unintended behaviour.
AI should therefore support, rather than replace, expert decision-making.
Different Tools Suit Different Security Tasks
ENISA concludes that general-purpose and specialised AI security tools may serve complementary roles.
General-purpose coding agents with security capabilities can provide a useful baseline for routine development activities, such as pull requests.
Specialised security harnesses may be better suited to deep repository audits requiring more extensive validation.
Seven-Step AI-Assisted Vulnerability Management Lifecycle
Based on the experiment, ENISA proposes a seven-step process for integrating AI into vulnerability management:
Select or develop appropriate agentic skills and security harnesses and run them in an isolated environment.
Use reputable AI models to identify and classify vulnerabilities.
Deduplicate, triage and prioritise findings with human validation.
Use controlled AI-assisted proof-of-concept exploits to confirm real-world impact.
Report validated issues through the appropriate CVD channel.
Generate remediation guidance and patches for human review.
Monitor token usage and operational costs.
The process should be repeated continuously and improved using feedback from previous testing.
The lifecycle diagram on page 14 visualises these seven steps as a continuous AI-assisted vulnerability management loop, from agentic skill development through discovery, triage, controlled exploitation, disclosure, remediation and cost assessment.
Relevance for Medical Device and Digital Health Manufacturers
Although the ENISA/CERT-EU experiment was not specific to medical devices, its findings are highly relevant to organisations developing:
Software as a Medical Device;
connected medical devices;
AI-enabled medical technologies;
cloud-connected healthcare platforms;
embedded device software.
Secure software development and vulnerability management are increasingly important components of medical device cybersecurity.
Potential Role in Secure Software Development
For medical technology manufacturers, AI-assisted code review could potentially support activities such as:
secure code review;
vulnerability detection;
cybersecurity verification;
software maintenance;
post-market vulnerability management.
However, the ENISA findings reinforce that AI outputs should not be treated as self-validating evidence.
Human experts must still determine whether identified vulnerabilities are technically valid, clinically relevant and accurately prioritised.
Human Accountability Remains Central
Perhaps the most important message from the joint advisory is that AI can increase the speed and scale of cybersecurity work, but human experts remain accountable for the final decisions.
Experts are still required to:
validate findings;
assess severity;
contextualise risk;
prioritise remediation;
coordinate disclosure;
approve patches;
ensure tools are used safely.
