ENISA Says Frontier AI Flagged 220 Flaws in EU Code, 95% Confirmed Real

Four frontier AI models scanned 27 open-source codebases maintained by EU bodies and produced 220 potential vulnerability findings — and 95% of the findings assessed so far proved real. That is the headline result of a joint advisory published by the European Union Agency for Cybersecurity (ENISA) and CERT-EU, the cybersecurity service for EU institutions. Four of the confirmed flaws have received new CVE identifiers.

The advisory describes a framework for evaluating frontier AI models in security-focused code audits. It lands under Key Action 4 of the EU Action Plan on Cybersecurity and AI, which requires guidance on protecting against AI-powered threats and securely integrating AI into cybersecurity operations by Q3 2026.

What exactly did ENISA test?

ENISA, with CERT-EU support, tested four models accessed through structured access programs: OpenAI's GPT-5.5 Cyber, GPT-5.6 Cyber, GPT-6 Astra, and Anthropic's Mythos 5. The agencies characterise them as "frontier AI models with advanced cybersecurity capabilities." The available reporting does not detail their exact capabilities, release status, or independent benchmark performance.

The models analysed source code only. No live applications or deployment contexts were provided. The 27 codebases consisted of 25 already open-source projects and two that will be published soon.

How were the audits run?

The agencies compared two tooling approaches. General-purpose coding agents equipped with security skills or plug-ins ran faster and cost less. CERT-EU's specialised harness, called Vigilo, performed additional analysis steps and cut the number of unsubstantiated findings — but consumed more time and more tokens.

ENISA also built two custom skills for the workflow: Code Auditor for the auditing stage and Findings Browser Report for reporting.

What do the numbers actually show?

The models flagged 220 potential issues across the 27 codebases. At publication time, code owners had completed assessment of 88 findings. Of those, 95% were confirmed as true positives. Four CVEs have been assigned.

ENISA itself flags the limitation: the high true-positive rate applies only to the assessed subset. The remaining 132 findings have not yet been reviewed. The figure describes 88 confirmed-real findings out of 220 total — not the full batch.

The advisory and experiment report are ENISA and CERT-EU publications describing the agencies' own methodology and results.

What are the limits of the experiment?

ENISA stresses that AI cannot replace human judgement. Without deployment context, models may overestimate the practical impact or severity of an issue. The volume of findings can also create a significant review burden for code owners.

The experiment has other known gaps:

• Total effort and cost, including token usage and expert review hours, are not disclosed.
• No comparison exists against traditional static analysis tools or human-only audits on the same codebases.
• The advisory sets no timeline for assessing the remaining 132 findings or updating the framework.
• Independent replication with other models or codebases has not been reported.

The report acknowledges that the absence of deployment context limits severity assessment.

What should organisations do?

The advisory recommends three practices for organisations considering similar AI-assisted reviews:

• Work in a secure, isolated environment.
• Ensure qualified human experts review all results and their severity.
• Follow established coordinated vulnerability disclosure processes.

The recommendations sit inside a broader policy push. The EU Action Plan on Cybersecurity and AI sets three objectives: promoting the safe and responsible use of advanced AI, reinforcing EU cybersecurity resilience, and scaling up Europe's AI capabilities for cybersecurity.

What happens next?

The remaining 132 findings await assessment, and ENISA has not said when that review will finish or how the framework will evolve with further experience. For security teams weighing AI-assisted audits, the advisory offers one concrete takeaway: frontier models can surface real vulnerabilities at a striking confirmation rate, but only qualified humans, working in isolation with proper disclosure processes, can decide what those findings mean.