The ENISA and CERT-EU joint advisory of November 2026 found that frontier AI models reported 220 potential issues across 27 codebases of EU institutions. Code owners had assessed 88 of the findings by publication and confirmed 95% of them. The AI tools rated severity higher than the code owners did, so expert human triage remains essential.
The advisory is "Joint Advisory on the Use of Frontier AI Models for Code Review", published by ENISA with CERT-EU under key action 4 of the EU action plan on cybersecurity and AI (DOI 10.2824/7940736, CC BY 4.0). Every figure below comes from that document.
Key takeaways
- Frontier AI models reported 220 potential issues in 27 codebases. 25 of the codebases were open source and 2 were about to become open source.
- Code owners confirmed 95% of the 88 findings they had assessed, and the experiment led to 4 new CVE IDs.
- The AI tools rated 42 of the 88 assessed findings critical or high. After review, the code owners rated 22 of the 88 high.
- By publication, code owners had assessed only 40% of the findings. The advisory names expert triage time as the constraint.
- All scans together cost about EUR 6,649, or about EUR 132 per 10,000 lines of code.
What did ENISA and CERT-EU test?
ENISA used frontier AI models to review the source code of open-source software that EU institutions, bodies, offices and agencies maintain. The models were OpenAI GPT-5.5 Cyber, GPT-5.6 Cyber and GPT-6 Astra, and Anthropic Mythos 5, through the providers' structured access programmes.
The models ran in client tools (Codex, OpenCode) with security skills or plug-ins, and in Vigilo, the security harness that CERT-EU released as open source in September 2026. The reviews used source code only. No live application was tested, and the models had no information about production deployments. The scans ran in August 2026, in an isolated container environment.
How accurate were the AI findings?
Code owners confirmed 95% of the 88 assessed findings as true positives. The remaining 5%, 4 findings, were false positives or not applicable, mostly because the AI tools did not have the runtime context.
The 95% rate covers only the assessed 40% of findings. A true positive in this count can still have low impact. The code owners rated 9 of the 88 assessed findings informational.
Did the AI rate severity correctly?
No. The AI tools rated severity higher than the code owners did. The advisory states that the severity of a finding can rarely be determined from source code alone, because it depends on reachability, privileges, trusted components and accepted risks.
| Severity | AI rating (88 findings) | Code owner rating (88 findings) |
|---|---|---|
| Critical | 3 | 0 |
| High | 39 | 22 |
| Medium | 30 | 29 |
| Low | 16 | 24 |
| Informational | 0 | 9 |
| False positive | 0 | 4 |
Source: Figure 6 of the advisory. The advisory also gives an AI severity split for all 220 findings in Figure 2. This post uses Figure 6, because only Figure 6 pairs each AI rating with a code owner rating.
The type of tool mattered. Code owners kept the severity that Vigilo assigned in 74% of cases, against 60% for general-purpose coding agents with a security skill or plug-in. Vigilo challenges every finding with an adversarial critique step before it reports.
What did the experiment cost?
ENISA estimates the total cost of all scans at about EUR 6,648.90, for 611,486,042 tokens. The average cost per 10,000 lines of code was about EUR 132.27. The figures are indicative, because ENISA had free access to the models.
General-purpose coding agents were faster and cheaper. Vigilo took longer and cost more, because it runs extra steps such as adversarial validation and patch generation. Repository size was not the only cost driver. The type of codebase, its architecture and its number of entry points also changed the run time.
Why is triage now the bottleneck?
Code owners received all 220 findings in August 2026. By publication in November 2026 they had assessed 88. The advisory says that validating, prioritising and fixing findings still needs time and expert effort, and that this work cannot yet be accelerated to the same extent as discovery.
Observation 13 sets duties on both sides. Reporters should deduplicate and, as far as possible, verify AI output before they report it. Where full verification needs deployment context that only the code owner has, the reporter should say so when the finding is shared. Code owners need enough time and resources to assess AI-identified findings with due diligence.
What does the advisory mean for manufacturers under the CRA?
A manufacturer of a product with digital elements must have a coordinated vulnerability disclosure policy and a contact address for vulnerability reports under Annex I Part II of Regulation (EU) 2024/2847. AI tools make more reports likely, and many of those reports will carry a severity claim made from source code only.
Three practical steps follow from the advisory.
- Ask how the finding was confirmed. A report confirmed in source code only needs your deployment facts before its severity is trusted.
- Keep severity a human decision. In the experiment, the code owners rated 22 of the 88 findings high, against 42 critical or high from the AI tools.
- Keep the Article 14 test separate. The method of discovery does not start the Article 14 clock. Evidence of active exploitation does. See Does AI vulnerability discovery change CRA Article 14 reporting?.
The advisory's annex sets out a seven-step cycle for AI-assisted vulnerability management. Steps 3 and 5 are triage by qualified human experts and reporting through the CVD channel of the code owner.
How does CVD Portal support this?
The CVD Portal submission form asks two optional questions. The first asks if AI tools found or helped find the finding. The second asks how the reporter confirmed it. The triage page shows the answers, and for a finding confirmed in source code only it asks the team to check the claimed severity against their deployment. Researchers and their agents can send the same two fields through the public MCP tool. See the submission form documentation.
Frequently asked questions
How many vulnerabilities did AI find in the ENISA and CERT-EU experiment?
Frontier AI models reported 220 potential issues across 27 codebases of EU institutions in August 2026. By the November 2026 publication, code owners had assessed 88 of the 220 findings. They confirmed 95% of the 88 as true positives, and the experiment led to 4 new CVE IDs.
Do AI models rate vulnerability severity correctly?
Not without deployment context, according to the ENISA and CERT-EU advisory of November 2026. The AI tools rated 42 of 88 assessed findings critical or high. After review, the code owners rated 22 of the 88 high, and most changes were downgrades. The advisory says severity can rarely be set from source code alone.
What did the ENISA AI code review experiment cost?
ENISA estimates the total cost of all scans at about EUR 6,649, or about EUR 132 per 10,000 lines of code, for 611 million tokens. The figures are indicative. The model providers gave ENISA free access through their access programmes.
What should a vulnerability reporter say about an AI-found finding?
The ENISA and CERT-EU advisory asks reporters to deduplicate and, as far as possible, verify AI output before they report it. Where full verification needs deployment context that only the code owner has, the reporter should say so when the finding is shared.