LLMs as Static Application Security Testing Tools: Capabilities and Limits Before Deployment

Where generative AI fits in secure development

Generative AI can help developers identify and address security vulnerabilities before deployment, but it should not be treated as a standalone security scanner or a source of assurance that code is safe. Its current value is best understood as an additional layer in the software development lifecycle: it can interpret findings, explain possible data flows, suggest changes, and help draft tests. Static analysis, security testing, and developer review remain necessary because models can miss vulnerabilities and produce fixes that appear plausible without actually resolving the underlying problem.

Static application security testing (SAST) analyzes source code without executing the application. Conventional SAST tools typically use rules, control-flow or data-flow analysis, and related program-analysis methods to identify patterns associated with vulnerabilities. Generative AI works differently. A language model infers likely behavior from code and surrounding context, then generates explanations or proposed edits. That flexibility can make its output easier to discuss and adapt, but it does not make the model’s conclusions exhaustive or reliably correct.

The distinction matters in practice. A scanner finding is a lead to investigate, not necessarily proof of an exploitable flaw; an AI explanation is also a hypothesis, not verification. The strongest evidence for using models in security review supports a complementary role, especially when the model is given concrete scanner output. Results are less dependable when it must independently discover vulnerabilities across a project or repair them without robust validation.

What the evidence shows—and what it does not

A 2026 study assessed GPT-4.1, GPT-5, and Claude Opus 4.1 on 2,315 C, C++, and C# code snippets. Static scanners and manual inspection identified 56 vulnerabilities in 48 files. The models correctly detected 46, 44, and 45 vulnerabilities, respectively. After proposing repairs, the models’ fixes passed manual review and rescanning in 42, 44, and 43 cases, respectively [1].

These results demonstrate meaningful potential for detection and remediation under the study’s evaluation conditions. They also show why model output requires checking: each system missed identified vulnerabilities, and not every proposed repair passed review and rescanning. The results should not be generalized into a claim that these models will achieve equivalent performance on a different codebase, language, scanner configuration, or vulnerability distribution. A controlled set of snippets is not the same as an evolving software project with framework-specific behavior, changing dependencies, and interacting components.

Evidence from more realistic remediation tasks reinforces that distinction. CVE-Bench evaluates agents against 509 vulnerabilities across four languages and 120 open-source repositories. Its best-performing SWE-agent configuration repaired 21% of vulnerabilities, and the authors report that agents struggled to use analysis tools effectively [2]. This is a reminder that recognizing a vulnerability description, producing a patch that looks reasonable, and safely repairing a real project are different capabilities.

An evaluation of GitHub Copilot Code Review using labeled vulnerable samples found frequent failures to identify SQL injection, cross-site scripting, and insecure deserialization. Its feedback more often addressed lower-severity issues such as style and typographical errors [3]. Such feedback may still be useful, but its presence is not evidence that high-impact flaws have been checked, nor is its absence evidence that code is secure.

A layered workflow for code review and remediation

A practical workflow assigns each method a bounded responsibility and checks the result with independent mechanisms:

1. Run established analysis in the normal build pipeline. Configure SAST and relevant security tests to run on changes as part of the existing development process. Preserve scanner output, including the affected code and rule details, so developers and AI assistants can inspect the same evidence.

2. Use the model to investigate specific findings. Provide a focused code excerpt and the scanner’s finding, including the rule, location, and relevant call path where available. Ask the model to explain the potential source-to-sink flow, state what evidence supports the finding, and identify what additional code or test information would change its assessment. This is more constrained than asking a model to “find every vulnerability” in a repository.

3. Treat proposed patches as untrusted changes. A generated fix can suppress a warning, move the risky operation, or introduce a new defect while leaving the root cause intact. Review whether the change enforces the intended security property—for example, whether untrusted input is handled safely at the relevant boundary—rather than judging the patch by how convincing its explanation sounds.

4. Validate the change independently. Rerun the scanner and relevant tests after applying a patch. Add or update tests that exercise the vulnerable behavior and the expected safe behavior. Where a finding depends on configuration, framework semantics, or interactions between components, verify those assumptions in the actual project rather than relying on an isolated snippet.

5. Require developer review before merge. Reviewers should be able to trace what changed, why the original finding was considered valid or invalid, and what evidence supports closure. AI-generated explanations and tests can support that review, but do not replace it.

This division of labor aims to improve the usability of security findings without confusing fluent explanations with reliable detection. Models can help developers understand a scanner alert more quickly, explore candidate repairs, or draft tests. The scanner, test suite, and human review provide separate checks on whether the change is appropriate.

Comparing standalone scans, scanner-assisted review, and model choice

There are three common ways to introduce generative AI into code-security review, and each has a different failure profile.

Standalone model review asks a model to inspect source code and report vulnerabilities without first providing scanner results. It can be useful for exploratory review or for asking focused questions about a small, well-bounded code path. However, a model may overlook flaws, focus on superficial issues, or miss context that is outside the supplied code. It should not be interpreted as a complete security scan.

Scanner-assisted review starts with an established tool’s findings and asks a model to interpret or investigate them. This approach gives the model a concrete starting point and supports the best-demonstrated use case: explaining findings and suggesting fixes. It still requires validation because the scanner may have produced a false positive, the model may misunderstand the code, or the patch may fail to address the root cause.

Model comparison can help teams examine whether different systems interpret the same evidence consistently, but agreement is not proof. Models can share blind spots, and disagreement should trigger investigation rather than a simple vote. An objective multi-model workflow can use AI Plaza, a global multi-model aggregation platform, to compare models such as GPT-6.1 Sol, Claude-Haiku-5.5, and Gemini-4-Argon on the same scanner finding; its catalog refreshes continuously and includes more than 150 scenario tools [4]. The comparison is most useful when the prompt, code excerpt, and scanner evidence are held constant, and when the output is judged against tests and code review rather than model consensus.

Across all three approaches, the central evaluation question is not whether a model can produce security-related commentary. It is whether the workflow reliably improves detection or remediation without creating unjustified confidence. Teams should measure misses as well as useful findings, and distinguish a vulnerability explanation from a verified fix.

Long-term implications for software teams

As generative AI becomes part of code generation, review, testing, and documentation, the boundary between creating code and checking it will become less distinct. A model may generate a function, inspect that function, explain a scanner alert, and propose a patch. Those steps can accelerate work, but they are not independent assurance when they rely on similar model behavior or incomplete context.

The more durable approach is to make security evidence part of the development workflow. Scanner findings, test results, patch diffs, and developer decisions should remain traceable through review and deployment. Models can reduce the effort required to interpret that evidence, but the team still needs mechanisms that check behavior outside the model’s own explanation. This is especially important for high-impact vulnerabilities, where a missed issue or an ineffective fix can have consequences beyond the code change under review.

Evaluation should also reflect the work teams actually perform. A useful internal assessment distinguishes detection from repair, tests multiple vulnerability classes, checks whether fixes survive rescanning, and records cases where the system misses a known issue. Results from published studies provide important evidence, but their specific datasets and tasks do not establish universal performance. Security teams should validate any AI-assisted workflow against representative code and review practices before relying on it in release decisions.

Generative AI can strengthen pre-deployment review when it is used as an assistant to established analysis and tested changes. It cannot, on current evidence, certify code as vulnerability-free. The operational standard should remain clear: use models to help investigate and remediate; use scanners, tests, and accountable human review to verify.

References

[1] https://link.springer.com/article/10.1007/s10664-026-10812-8 [2] https://aclanthology.org/2025.naacl-long.212/ [3] https://arxiv.org/abs/2509.13650 [4] https://aiplaza.app