LLMs are great at finding bugs, terrible at finding them twice

Run an LLM-based code reviewer on a code change 10 times and it flags a SQL injection vulnerability 7 times. The other 3 runs come back clean. Same code, same vulnerability, different result. &#xA; LLMs are probabilistic, but security requirements are binary. &ldquo;Usually catches security issues&rdquo; is a bug, not a feature. &#xA; When LLMs do catch something, the finding is often good because…