ICpanda completes two AI-assisted security reviews of dMsg

ICpanda has completed two rounds of AI-assisted source code security reviews for dMsg, its private team collaboration project, reporting that all six identified issues have been fixed and tested.

The reviews were conducted using OpenAI’s GPT-6 Astra model. According to the project announcement, the assessment identified six findings, all of which have since been addressed in the code.

ICpanda said it also carried out before-and-after regression testing to verify the fixes and check that the reported issues had been resolved.

The work focuses on access controls within dMsg, particularly how AI agents interact with sensitive information and perform actions on behalf of users. The project aims to ensure that agents can access data only when they have explicit permission.

ICpanda said private collaboration requires clear boundaries around who can view information and authorise actions, rather than relying on encryption alone.

The team has published the security reports on GitHub, along with details of the findings, code changes, testing evidence and remaining gaps, allowing developers and other interested parties to examine the work.

However, ICpanda has clarified that the reviews do not amount to independent third-party certification and should not be interpreted as proof that the software is free from vulnerabilities.

The announcement highlights the growing use of AI-assisted tools in software security reviews, while also pointing to the need for independent scrutiny and ongoing testing as applications become more complex.