How Often Are AI-found Code Flaws Real?

Nikesh Arora says a model that has learned what good code looks like can also point at bad code. Attackers only need one real vulnerability. Defenders have to find every one and patch it.

When Mythos first looked for bad code, Arora says it was hallucinating 30 percent of the time. He guesses that among people who have tested those findings, roughly 60 to 80 percent have been real and 20 percent have been hallucinations. He does not think anyone will patch from a flawed suggestion without testing it again.