AI-Accelerated Vulnerability Discovery, Program Analysis, and Analysis Integrity Crisis

Anthropic's OSS Scanner, IBM/Red Hat, and Microsoft's FORGE report large volumes of AI-assisted findings, but Google's pause in OSS vulnerability reporting shows that invalid automated submissions can overwhelm intake. Sandboxed reproduction, human review, deduplication, exploitability validation, and controlled agent permissions remain essential; broad autonomous-AI strategy commentary adds governance context but little new technical evidence.