LLMs are great at finding bugs, terrible at finding them twice
Run an LLM-based code reviewer on a code change 10 times and it flags a SQL injection vulnerability 7 times. The other 3 runs come back clean. Same code, same vulnerability, different result. 
 LLMs are probabilistic, but security requirements are binary. “Usually catches security issues” is a bug, not a feature. 
 When LLMs do catch something, the finding is often good because…