Our AI agent "passed CI" and still got flagged by security review. Anyone else hitting this wall?