I am pretty confident there is no AI involved, but just a regular deterministic code analysis tool that flags potential discrepancies between code and demanded permissions.

We usually simply call those bots (there can be AI bots too, but there seems to be no indication that this is one).