Finding bugs and vulnerabilities in the AI era — what’s changed?
AI increases code volume faster than verification quality, so it can ship more defects, not fewer. The article argues for wrapping AI around deterministic tools such as testing engines and static analyzers, with a curated feedback loop between them.
It is easy to say that with AI, fewer defects are shipped. It is not true, not even close: AI increases code volume faster than it increases verification quality.
The essay walks through why. AI predicts tokens rather than reasoning, and it is trained on a corpus of human code that was never defect-free to begin with. What makes it useful is a curated feedback loop: test results, defect and vulnerability scans, traces and runtime state fed back before the next prediction. For that loop to be representative, it needs sophisticated testing environment engines and deterministic static analysis, which offer reproducibility, precise models and SMT-backed confidence that agentic AI cannot.
The conclusion: AI is best at generating hypotheses, deterministic tools are best at providing evidence, and the future is AI wrapped around controlled determinism.