Security Audits with AI: Checking Code for Vulnerabilities

AI agents catch a lot of security issues automatically – but critical findings always need a human to confirm them.

What an AI security audit does

An AI agent reads your code or a diff and scans it for known vulnerability patterns: SQL injection, unsafe deserialization, hardcoded passwords, missing authorization checks. That's far faster than reading every line by hand.

Typical findings

Common finds include injection flaws (SQL, command, XSS), missing authorization checks, exposed secrets like API keys, weak cryptography, and unsafe calls like eval(). These patterns show up in real code again and again, usually from time pressure or oversight.

Where the limits are

An agent can spot patterns, but it doesn't automatically understand your threat model: who the attacker is, what the most valuable target is, which trade-offs are acceptable. A finding can be harmless in one context and critical in another – only someone who knows the system can tell the difference.

A human checks anything critical

Automated review is a first pass, not a replacement for human judgment. For findings touching authentication, payment data, or access rights especially: get a human to confirm before you mark it fixed or dismiss it. And a security tool built on AI can itself be fooled by malicious text hidden in code – reviewing unknown, untrusted code needs extra caution.

EXAMPLE

Example prompt: 'Use a subagent and check the login route's diff for security issues: injection, missing authorization, exposed secrets. Categorize each finding by OWASP category and flag what a human needs to confirm before merge.'

🛠️ EXERCISE — TRY IT YOURSELF

Have an agent review a small, deliberately insecure code snippet (e.g. a login function with string-concatenated SQL) for security issues.

Write or grab a function with a known flaw, e.g. `query = "SELECT * FROM users WHERE name='" + input + "'"`.
Have the agent review the function and categorize findings by OWASP category (injection, auth, etc.).
Ask specifically: 'Which of these findings would need human confirmation before a real merge, and why?'

✅ SELF-CHECK

☐ Did the agent correctly identify and name the SQL injection?
☐ Did it assess severity realistically, or just say 'dangerous' in general?
☐ Could you explain why a finding like this needs human confirmation before you mark it resolved?

QUICK QUIZ

Why doesn't an AI security review replace human judgment on critical findings?