How do you audit and catch subtle security flaws in AI-generated code before shipping to production?

Using AI generators has helped us ship CRUD endpoints and API integrations three times faster, but in a recent audit, we caught a subtle SQL injection vector and unsanitized user input that slipped past basic code reviews. Because AI-generated code looks syntactically clean and correct at a glance, team members tend to skim during PR reviews.

For teams building user-facing or sensitive applications with AI, what automated security guardrails or PR review workflows do you put in place to intercept AI security hallucinations?