ML/AI solutions are not applicable to every problem. Validating Python code on security weakness is a area where using ML/AI technology should only be applied with care.

- SAST scanners created with AI vibe-coding tools and

- SAST scanners that use AI agents for scanning your code.

- Unlike traditional software governed by explicit, deterministic logic, **AI/ML models are probabilistic**. This means that even with identical input code, outcomes can vary due to stochastic (random) processes during training, parallel processing on hardware, and the use of 'temperature' or 'seeds' in generative outputs.

:::{danger}

So DO NOT rely on SAST scanners that are powered by AI-agents / LLM systems to solve your cyber security problems! AI agents are still struggling to write secure code.

AI solutions that are built upon LLMs for cyber security problems are still far from mature. HIDS systems (Host Intrusion Detection Systems) have a long history of applying ML technologies as well as spam-filters. Creating security products that ‘learns’ from patterns is not new for security. AI/ML technologies have been applied for many years for HIDS systems and spam-filters. Applying AI for cyber security has been done for many years with variable success.

AI/ML technologies can and do help with cyber security, especially with DAST (Dynamic Application Security Testing) and creating better fuzzers. Cyber security professionals should be conservative with adopting new IT hypes for security testing tools. IT hypes like AI-agents and LLMs are not the holy grail for solving our cyber security problems. This is because in the end you always pay more for cyber security solutions, but the risks still remain. Cyber security is not a product, but a process.

[Python Code Audit](https://codeaudit.nocomplexity.com), a modern Python-specific SAST scanner, uses AI/ML in an ethical and secure way. See the Python Code Audit [documentation](https://nocomplexity.com/documents/codeaudit/architecture.html#use-of-ai) for a deep dive into how AI/ML is used within this tool.