arkoVulnerability discovery is changing.
Anthropic has reported using AI to discover previously unknown vulnerabilities in open-source software, followed by human validation. The UK AI Security Institute describes cyber capabilities as dual-use: they can help defenders and can also be misused. These findings concern the systems and conditions studied; they do not establish what every model can do. Read Anthropic’s research and the AISI Frontier AI Trends Report.
Connect discovery to a reviewed change.
For engineering teams, the practical response is to inspect generated changes while their purpose is clear, prioritise findings in application context, review proposed fixes and retain evidence of the completed recheck. Keep those controls available in both editor and agent workflows.
Look across the places code is created.
Your organisation may use several editors, coding agents, repositories and delivery pipelines. Each can produce changes on a different cadence. Make that distributed workflow visible before deciding where controls belong.
Put a shared policy into the workflow.
A policy is useful when the people and agents making changes can act on it. Define the security baseline, approved patterns and review thresholds, then connect them to the integrations your teams actually use.
Keep the check independent.
A coding agent can propose an implementation and a fix. A separate check supplies another basis for the decision. Ask for the finding, supporting context, proposed remediation and result of the recheck.
Make the evidence useful to a decision-maker.
Show what was analysed, what completed and what changed. Connect the developer’s local action to the organisation’s review, without turning an illustrative result into a claim about the whole estate.
Start with one connected workflow.
Choose a project and a coding tool. Establish an explicit check-and-recheck workflow, then discuss how it should extend to repository checks, CI and enterprise oversight.