My AI reviewer found nothing for months. I read that as good news.

Short summary

A developer using AI agents to build and review hospital internal tools discovered that their AI security reviewer found zero defects over months, while external humans found eight real issues in days. The root cause: role separation with the same underlying model is not independence — both agents share the same structural blind spots. The key lesson is to treat AI reviewers as instruments that must be validated with seeded defects, not as trusted colleagues whose silence means safety.

• •AI reviewer using same model as implementer shares structural blind spots, not independence
• •External humans found 8 real defects that the AI reviewer missed for months
• •Treat AI reviewers as instruments: seed known flaws to validate they can still detect problems

Generated with AI, which can make mistakes.