Your Developers Are Letting AI Answer Your Security Findings

Are your developers still reading their security findings, or are their agents answering for them? Ahmad Sadeddin, founder and CEO of Corgea, brings data from Corgea's customers: replies to security comments written with em dashes jumped from 2.5 percent in May to about a third, and once long, verbose replies are counted, somewhere between 35 and 60 percent come from agents. Chris and Ahmad dig into developers using agents to wave off findings as false positives, why commits per PR keep climbing, and what Ahmad calls headless AppSec, where agents review, triage, and fix for other agents. They debate what AI security review really costs, whether non determinism is a dealbreaker when human reviewers were never consistent either, and why roughly 45 percent of developer false positive calls are wrong. This episode is sponsored by Corgea. Design it. Build it. Ship it. Corgea secures it. About Corgea Corgea is an AI-native application security platform that secures software from design to production. It brings together security design reviews, AI SAST, dependency and IaC scanning, code quality checks, and autonomous pentesting—helping security and engineering teams find risk earlier, fix what matters, and ship securely. → Learn more about Corgea Connect with Ahmad Sadeddin: → Corgea → Corgea on LinkedIn Mentioned in this episode: → GitHub stacked pull requests (public preview) → Claude Mythos Preview and Project Glasswing → Corgea Build vs. Buy SAST calculator Follow the Application Security Podcast: ➜ Home: appsecpodcast.com ➜ X: @AppSecPodcast ➜ LinkedIn: The Application Security Podcast ➜ YouTube: @ApplicationSecurityPodcast ➜ Instagram: @appsecpodcast ➜ Facebook: Application Security Podcast Chapters: 00:00:00 - Cold open: AppSec is going agent to agent 00:00:21 - Meet Ahmad Sadeddin 00:00:37 - Welcome and a sponsor disclosure 00:01:36 - Ahmad's security origin story 00:02:54 - From payments security to founding Corgea 00:05:01 - Security budget vs. security by design 00:07:57 - Will AppSec miss the boat on AI? 00:09:55 - Security is taste 00:10:49 - You can inform the model, but you can't mandate it 00:12:29 - Where autonomous agents should never run 00:13:53 - Inside Corgea's research on developer responses 00:16:11 - No human uses an em dash 00:17:28 - Good thing or bad thing? 00:18:16 - Weaponizing agents to mark false positives 00:20:41 - Are agents making developers worse at security? 00:22:36 - Long replies put agent responses at 35 to 60 percent 00:24:20 - Non determinism and an overnight agent loop 00:26:15 - The Miss America problem: AI reviews that never stop 00:28:32 - More commits per PR, and why 00:30:40 - Headless AppSec: agents talking to agents 00:32:44 - Token burn and AI budgets 00:34:34 - LLM courage and the real cost of AI security review 00:36:39 - Prediction: AI budgets get scrutiny 00:38:04 - Can AI ever be deterministic? 00:39:14 - Humans aren't deterministic reviewers either 00:41:52 - Takeaway: 45 percent of false positive calls are wrong 00:44:29 - A risk score on every PR 00:46:45 - Canary deployments for AI code review 00:47:28 - Wrap up: measure your own repos