Reviewed: three SAST tools vs. assistant-written repos

§ 1The pitch decks say assistant-written code breaks static analysis. The data says something more useful: it breaks the default rulesets, which were tuned on a decade of human idiom. Point the same engines at generated code with adjusted configurations and the gap narrows sharply.

Method

Same corpus for all three tools: twelve services generated end-to-end with mainstream assistants, seeded with forty known-vulnerable patterns, plus two human-written controls. Vendor names are in the full tables; the pattern holds across all three.

What to do with this

Don’t buy a new scanner because your old one is noisy on generated code. Spend the week tuning, add provenance-aware triage so declared code gets the adjusted ruleset, and re-measure before renewal season.