The agent security reviewer only works once a second agent is paid to call it wrong

Eleven findings in four months works out to one real vulnerability per 27 pull requests ^[1], fewer than three a month ^[2]. That is the yield the whole apparatus has to justify, and it means the reviewer's normal output is silence. Anything that adds volume to that baseline buries it.

The bug class driving the build makes this worse. Broken access control sits at the top of the OWASP Top 10 and is invisible to pattern matchers, because the vulnerable code and the safe code are identical except for a missing ownership clause in the query ^[10]. Semgrep and CodeQL report known patterns well and return nothing at all for an endpoint that confirms you are logged in and never confirms the record is yours ^[7]. So there is no second opinion in the stack to grade the agent's findings against. The verifier agent is the only calibration available.

The mechanism worth copying is the incentive, not the model. An agent told to review a diff for security issues produced a wall of "consider validating user input" attached to code that already validated user input ^[17], because producing findings was the task. Two changes inverted that. The prompt became roughly 60 lines of enumerated threat classes, each requiring either a finding or an explicit "N/A" with a one-line reason per changed file, with silent skipping forbidden ^[18]. Then the second agent arrived, and its only success condition is refuting what the first one said ^[3]. Refuted findings are dropped and logged; survivors post as a blocking comment for a human to fix or dismiss ^[12].

Which leaves the number nobody published. The refuted findings are on disk, by the author's own description of the flow ^[12], so the raised-to-survived ratio exists. The post does not give it ^[3]. Without it, "caught 11" is a numerator, and the false-positive tax is the line an operator actually has to budget: a second model pass for every finding that dies, plus a human read for every one that lives ^[12]. That cost lands per push, which is why docs-only pushes skip the review entirely to avoid burning tokens ^[14], and why the gate is a plain pre-push hook plus a CI step rather than anything more ambitious ^[13].

The structural decisions are cheaper to adopt than the prompt. The reviewer is a separate agent with its own system prompt rather than another bullet in the implementation agent's instructions, and the author says that distinction mattered more than anything else in the build ^[11]. Its tool allowlist is read-only: read, grep, glob, and git diff, with no write access, no arbitrary shell, no push ^[15]. His reasoning is blunt: a reviewer that can edit code is not a reviewer, it is a second author ^[16].

The summary offered is that a language model can cover the gap pattern matching cannot, but only with an adversarial second pass ^[20]. Priced as a build, that means the unit of agent code review is two agents, and any plan that budgeted for one is wrong by an amount this data cannot tell you.