Public models can already spot that a security-relevant check is missing in the right code path, but they can still miss the actual invariant being violated and therefore misstate the impact.

A central pattern emerging in generative AI is a shift from 'thinking by doing' (e.g. writing a document) toward 'choosing from outputs' (e.g. prompting AI to write a document).