Notifications
Clear all
Topic starter
22/08/2026 12:01 pm
TL;DR: LLMs are amplifying vulnerability discovery in large codebases, and Teleport says 13 engineers spent three months pressure washing its codebase to find and fix dozens of bugs, with simple prompts outperforming more complex agentic harnesses. The practical shift is clear: security teams need human-led workflows that turn model output into focused triage, not noisy automation.
NHIMG editorial — based on content published by Teleport: We Had 13 Engineers Spend Three Months Finding Vulnerabilities with LLMs
By the numbers:
- Over the past quarter, Teleport had 13 software engineers dedicated to pressure washing its codebase with frontier models.
- Teleport says the team found almost twice as many high severity vulnerabilities in one quarter as it did in 2024 and 2025 combined.
Questions worth separating out
Q: How should security teams use LLMs to find vulnerabilities in large codebases?
A: Use LLMs as a focused review accelerator, not as an autonomous scanner.
Q: When does AI-assisted code review become less effective than manual review?
A: It becomes less effective when orchestration layers add more noise than signal, or when reviewers cannot rapidly validate what the model returns.
Q: What do security teams get wrong about agentic vulnerability hunting?
A: They often assume more agents and more stages will produce better results.
Practitioner guidance
- Limit agentic complexity in vulnerability review workflows Use simple, component-specific prompts and avoid multi-stage orchestration unless it measurably improves exploitable finding quality.
- Create a human triage gate for all AI-generated findings Require experienced engineers or security researchers to validate exploitability, deduplicate findings, and prioritise by actual risk before remediation work is scheduled.
- Focus AI-assisted review on identity-critical code paths Prioritise code that governs authentication, privilege checks, token handling, service account use, and secret storage.
What's in the full article
Teleport's full blog post covers the operational detail this post intentionally leaves for the source:
- The exact pressure-washing workflow the engineers used to target code components with LLM prompts.
- The examples of harness designs Teleport tried and why the more complex approaches created more noise.
- The bug-fix outcomes and release context for the vulnerabilities found during the quarter.
- The practical lessons the team drew from pairing expert humans with frontier models in security review.
👉 Read Teleport's post on using LLMs to find vulnerabilities in a large codebase →
LLM vulnerability hunting in codebases: what security teams should expect?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
22/08/2026 12:02 pm
LLM-assisted vulnerability discovery is now a governance problem, not just a tooling experiment. Once models can materially expand bug-finding capacity, the issue shifts from whether they can find flaws to how organisations control the review, validation, and remediation pipeline. That creates a governance burden across engineering, security, and risk functions, especially where code governs authentication, secrets, and access checks. The teams that win will be those that treat model-assisted review as a controlled operating process, not an ad hoc productivity hack.
A question worth separating out:
Q: How should security teams prioritise vulnerabilities when AI speeds up attack discovery?
A: They should prioritise by exploitable context, not by severity alone. A weakness on an exposed, reachable, and privileged asset deserves more attention than a higher-scoring issue that cannot be reached. For cloud and NHI programmes, the practical test is whether fixing the issue will materially shrink attack paths and blast radius.
👉 Read our full editorial: LLMs are changing vulnerability discovery in large codebases
