Yup. It's so bad that the cURL folks famously stopped accepting AI-generated reports because they were drowning in slop. So the post, which incidentally also

Yup. It's so bad that the cURL folks famously stopped accepting AI-generated reports because they were drowning in slop. So the post, which incidentally also looks AI-generated, is praising its ability to generate slop. Another thing with these success stories is that they often target old, incredibly crufty code bases which are practically guaranteed to have vulns in there somewhere, so you'll always get one or two wins in amongst the avalanche of slop. It'd be interesting to see how well this does against standard SAST benchmarks.