Are your developers still reading their security findings, or are their agents answering for them? Ahmad Sadeddin, founder and CEO of Corgea, brings data from Corgea's customers: replies to security comments written with em dashes jumped from 2.5 percent in May to about a third, and once long, verbose replies are counted, somewhere between 35 and 60 percent come from agents. Chris and Ahmad dig into developers using agents to wave off findings as false positives, why commits per PR keep climbing, and what Ahmad calls headless AppSec, where agents review, triage, and fix for other agents. They debate what AI security review really costs, whether non determinism is a dealbreaker when human reviewers were never consistent either, and why roughly 45 percent of developer false positive calls are wrong.
This episode is sponsored by Corgea. Design it. Build it. Ship it. Corgea secures it.
About Corgea
Corgea is an AI-native application security platform that secures software from design to production. It brings together security design reviews, AI SAST, dependency and IaC scanning, code quality checks, and autonomous pentesting—helping security and engineering teams find risk earlier, fix what matters, and ship securely.
→ Learn more about Corgea
Connect with Ahmad Sadeddin:
→ Corgea
→ Corgea on LinkedIn
Mentioned in this episode:
→ GitHub stacked pull requests (public preview)
→ Claude Mythos Preview and Project Glasswing
→ Corgea Build vs. Buy SAST calculator
Follow the Application Security Podcast:
➜ Home: appsecpodcast.com
➜ X: @AppSecPodcast
➜ LinkedIn: The Application Security Podcast
➜ YouTube: @ApplicationSecurityPodcast
➜ Instagram: @appsecpodcast
➜ Facebook: Application Security Podcast
Chapters:
00:00:00 - Cold open: AppSec is going agent to agent
00:00:21 - Meet Ahmad Sadeddin
00:00:37 - Welcome and a sponsor disclosure
00:01:36 - Ahmad's security origin story
00:02:54 - From payments security to founding Corgea
00:05:01 - Security budget vs. security by design
00:07:57 - Will AppSec miss the boat on AI?
00:09:55 - Security is taste
00:10:49 - You can inform the model, but you can't mandate it
00:12:29 - Where autonomous agents should never run
00:13:53 - Inside Corgea's research on developer responses
00:16:11 - No human uses an em dash
00:17:28 - Good thing or bad thing?
00:18:16 - Weaponizing agents to mark false positives
00:20:41 - Are agents making developers worse at security?
00:22:36 - Long replies put agent responses at 35 to 60 percent
00:24:20 - Non determinism and an overnight agent loop
00:26:15 - The Miss America problem: AI reviews that never stop
00:28:32 - More commits per PR, and why
00:30:40 - Headless AppSec: agents talking to agents
00:32:44 - Token burn and AI budgets
00:34:34 - LLM courage and the real cost of AI security review
00:36:39 - Prediction: AI budgets get scrutiny
00:38:04 - Can AI ever be deterministic?
00:39:14 - Humans aren't deterministic reviewers either
00:41:52 - Takeaway: 45 percent of false positive calls are wrong
00:44:29 - A risk score on every PR
00:46:45 - Canary deployments for AI code review
00:47:28 - Wrap up: measure your own repos
