A new study has demonstrated that Large Language Models (LLMs) can be used to identify 29 confirmed vulnerabilities, 12 denial-of-service issues, and 42 hardening recommendations in a mature whistleblowing platform, GlobaLeaks, at an affordable cost. This approach is changing the equation for teams building or defending critical software, making it more accessible and affordable than ever before.
Artificial Intelligence has revolutionized various aspects of our lives, and cybersecurity is no exception. The recent advancements in Large Language Models (LLMs) have brought about a significant shift in the way we approach code-level threat discovery. A new study has demonstrated that LLMs can be used to identify 29 confirmed vulnerabilities, 12 denial-of-service issues, and 42 hardening recommendations in a mature whistleblowing platform, GlobaLeaks, at an affordable cost.
The study, conducted by Pierluigi Paganini, highlights the potential of LLMs to make broad, patient, systematic reading cheap enough to be repeated at scale. This is particularly significant for teams building or defending critical software, as they can no longer assume that thorough code reading is too expensive for most adversaries.
The review was not run against neglected software. According to the report, the maintainers had landed 183 commits in the month before the reviewed snapshot during an intensive hardening and release cycle that included token hashing, session-state resets, tighter authorization, and new audit logging. This matters because findings uncovered in a codebase at one of its better-defended moments carry more signal than issues found in stale or abandoned software.
The distribution of cost across models was also revealing. One high-reasoning model accounted for 61.9% of total spend while processing only about 90 million of the 1.24 billion tokens used in the campaign, while cheaper models handled most of the broad reading volume at much lower cost. In other words, deeper reasoning was more expensive, but the gap was no longer large enough to act as a serious barrier.
The report produced 110 triaged records in total: 29 confirmed vulnerabilities, 12 denial-of-service findings, 42 hardening recommendations, and 27 retained non-findings kept for transparency. This choice matters because it shows not only what was found, but also what was considered and later set aside, which is a healthier way to present LLM-assisted research than pretending every model output is meaningful.
Some of the most important findings were not exotic at all. The report describes issues involving session-to-account takeover paths, whistleblower anonymity risks, tenant-boundary weaknesses, missing audit trails for sensitive actions, and availability problems that a single unauthenticated user could trigger. That is precisely what makes the result uncomfortable: the value of the LLM-assisted approach is not that it discovers magic bugs, but that it makes broad, patient, systematic reading cheap enough to be repeated at scale.
The report argues that this kind of analysis is now far more accessible than it used to be. This assumption no longer holds in the same way because commercial LLMs have changed the equation for teams building or defending critical software. A project that protects people at real risk can no longer assume that thorough code reading is too expensive for most adversaries, because commercial LLMs have made it more affordable and accessible.
The practical response is the one the report itself points to: continuous hardening, disciplined review, and the assumption that the next entity reading the code may be cheaper, faster, and more patient than the last. This approach is essential for teams building or defending critical software, as they can no longer rely on traditional methods of code-level threat discovery.
In conclusion, the recent study demonstrates the potential of LLMs to make broad, patient, systematic reading cheap enough to be repeated at scale. The findings highlight the importance of continuous hardening, disciplined review, and the assumption that the next entity reading the code may be cheaper, faster, and more patient than the last.
Related Information:
Published: Fri Jul 31 07:56:16 2026 by llama3.2 3B Q4_K_M