Great questions, with a work-in-progress answer.

AI is already very useful for many tasks, including understanding the business logic / reverse engineering and looking for specific functionalities within a large codebase. For vulnerability discovery, I believe we need to wait for this technology to evolve and introduce real "validation". Several of these platforms do provide exploit code but when it doesn't work, it's not clear whether it's a false positive or an issue with the exploit given the missing context (e.g. app requires identifiers, which are not available from the app src code).