ENISA: frontier AI models found 220 potential security flaws in EU institutions' open-source code

Frontier AI models found 220 potential security issues in open-source software maintained by EU institutions, according to a joint advisory from ENISA, the EU cybersecurity agency, and CERT-EU, published on 12 November.

ENISA used models it accessed through structured access programmes, including OpenAI's GPT-5.5 Cyber, GPT-5.6 Cyber and GPT-6 Astra and Anthropic's Mythos 5, to review the source code of 27 codebases, the report states. Only source code was examined; no live applications were tested. By publication, code owners had assessed 88 of the findings and confirmed 95% of them as genuine, and four new CVE identifiers had been assigned.

The agencies conclude that AI can speed up code review but cannot replace human judgement. Without deployment context, models can overstate how serious an issue is, and the volume of findings puts a heavy review load on code owners. General-purpose coding agents with security skills were faster and cheaper, while CERT-EU's specialised harness, Vigilo, produced fewer unsupported findings at the cost of more time and tokens. They advise organisations to run such reviews in isolated environments and have qualified experts check the results.