It seems the <sarcasm> tag was missing, I assume, but as shown by many companies and open source projects, agents with the right prompts are much better at finding security problems than 99% of developers (for various reasons).