If I ask an LLM to review my code it will find a long list of issues. Some of them will be real, and some of them will look kind of like issues, but won't really be when you dig into them. Sometimes the issues will be kind of real, in the sense that there's a real best practice not being quite followed, but they don't actually rise to the level of a bug or vulnerability, and they're not worth fixing.

If I fix that first list of issues, then ask an LLM to review my code again, it will, almost without fail, generate an equally long list of issues the second time. There might be some new real issues it missed in the first pass, but it will be much more slanted towards the "not quite a real issue" category, or duplicates of the "issues" I didn't fix.

By the third round of review, almost everything it produces will be useless.

I'm pretty sure this is what's going on with Project Glasswing.

Machine build to steal and plagiarize steals and plagiarizes. Shocked pikachu