Speaking as someone responding to security@ for a notable FOSS project (C code base dating back to 1996), a meta-comment:

Our current quota is, ca. 20% of AI-found "critical" issues are in fact critical. 3-5% of reported "high" are also critical (i.e. unfortunately it's not possible to rely on AI being excessively alarmist, it does under-classify some issues.) This is with erring towards higher severity though; we didn't get anything that'd e.g. make HN front page.

Simultaneously, ca. 35% of reported "critical" are not even actual security issues. (May be biased due to the nature of our project, AI seems to have issues understanding security boundaries.)

Possible some of this is due to "they're prompting it wrong". Hard to tell since we don't have access ourselves.

I've not seen major differences between models & vendors, but we mostly get reports from Anthropic. (We currently just treat them as functionally interchangeable, which is a data point in itself.)

> The total run cost $1,213,430 in API credits, or $1,279 per LPE exploit.

On a sidenote: I'm guesstimating the total cost on maintenance side will be 1x…10x of this. (Mostly humans to review fixes. And this isn't made cheaper by AI in my experience; to get a reasonable level of assurance regarding larger design aspects & co, you just end up spending a similar amount in tokens as the involved humans' time would cost.)