ENISA and CERT-EU Publish Advisory on Frontier AI for Code Review, Citing 95% True-Positive Rate in Limited Test

The European Union Agency for Cybersecurity (ENISA) and CERT-EU, the cybersecurity service for EU institutions, have released a joint advisory describing a framework for evaluating frontier AI models in security-focused code audits. The advisory accompanies an experiment in which four advanced AI models scanned 27 open-source codebases maintained by EU bodies, producing 220 potential vulnerability findings. Of the 88 findings assessed so far by code owners, 95% were confirmed as true positives, and four new CVE identifiers have been assigned [1].

Experiment Scope and Methods

The work was conducted under Key Action 4 of the EU Action Plan on Cybersecurity and AI, which calls for guidance on protecting against AI-powered threats and securely integrating AI into cybersecurity operations as of Q3 2026 [1]. ENISA, with CERT-EU support, tested four models accessed through structured access programs: OpenAI's GPT-5.5 Cyber, GPT-5.6 Cyber, GPT-6 Astra, and Anthropic's Mythos 5. The models analysed source code only; no live applications or deployment contexts were provided [1].

Two tooling approaches were compared. General-purpose coding agents with security skills or plug-ins were faster and less costly. CERT-EU's specialised harness, Vigilo, performed additional analysis steps and reduced the number of unsubstantiated findings, but required more time and more tokens [1]. ENISA also used two custom skills it developed: Code Auditor for auditing and Findings Browser Report for reporting.

Results and Limitations

Across the 27 codebases (25 already open-source, two soon to be), the models flagged 220 potential issues. At publication time, code owners had completed assessment of 88 findings, confirming 95% as true positives. Four CVEs have been assigned. ENISA notes the high true-positive rate applies only to the subset assessed; the remaining 132 findings have not yet been reviewed [1].

The agency stresses that AI cannot replace human judgement. Without deployment context, models may overestimate the practical impact or severity of an issue, and the volume of findings can create a significant review burden for code owners. The advisory recommends that organisations considering similar AI-assisted reviews work in a secure, isolated environment, ensure qualified human experts review all results and their severity, and follow established coordinated vulnerability disclosure processes [1].

Claims vs. Evidence

The advisory and experiment report are ENISA and CERT-EU publications; they describe the agencies' own methodology and results. The 95% true-positive figure is based on 88 assessed findings out of 220 total. The models used — GPT-5.5 Cyber, GPT-5.6 Cyber, GPT-6 Astra, Mythos 5 — are characterised as "frontier AI models with advanced cybersecurity capabilities" accessed via structured access programs. The available reporting does not detail their exact capabilities, release status, or independent benchmark performance. The experiment did not test live applications or provide deployment context, which the report acknowledges limits severity assessment.

Context

The EU Action Plan on Cybersecurity and AI sets three objectives: promoting the safe and responsible use of advanced AI, reinforcing EU cybersecurity resilience, and scaling up Europe's AI capabilities for cybersecurity [2]. Key Action 4 tasks ENISA with issuing guidance, recommendations, advisories and best practices on the protection against AI-powered threats and for the secure integration of AI in cybersecurity operations [1].

What Remains Unknown

• The total effort and cost of the experiment, including token usage and expert review hours, are not disclosed.
• No comparison is provided against traditional static analysis tools or human-only audits on the same codebases.
• The advisory does not specify a timeline for assessing the remaining 132 findings or for updating the framework based on further experience.
• Independent replication of the results with other models or codebases has not been reported.