Why AI Agents Shouldn't Guess at Vulnerability Exploitability
DevOps.com, Thursday, September 10th, 2026
Determining exploitability needs deterministic graph traversal of the supply chain, not language model inference.
Vulnerability prioritization depends on whether a flawed function is actually reachable from your code, and that is a graph traversal problem over the software supply chain rather than something a language model should infer.
The article's key line is that better model quality does not solve missing data: if the dependency graph does not record how a package is invoked, no amount of reasoning recovers it.
The argument has practical force as security teams adopt AI triage tools, because a confident wrong answer about exploitability is worse than an unranked list. Deterministic analysis first, then AI for explanation.