The API says if no security group is specified for a run instance command, the default group will be used.