DIY LLM vulnerability scanner finds 10 bugs for ~$20/day, 8 novel vs CodeQL
_h4xr · reddit · 2026-11-08
After Anthropic's Mythos and OpenAI finding 1000 Linux kernel vulnerabilities ($1000 each blended), the author tried making LLM-driven vulnerability discovery cheap: use LLMs only where reasoning is needed, keep everything else deterministic.
Five-stage pipeline:
- Code Context Graph: parse the whole codebase into a compiler-grade graph (100K–1M+ nodes)
- Hunting: resolve user-data sources to dangerous sinks, enumerating 1000–5000 paths
- Flow validation: an LLM reasons over each source→sink path (Confirmed/Blocked) with a query budget for missing details — hundreds of paths remain
- Condition stage: verify trigger conditions and whether default configs block the flow — tens remain
- Adversarial challenge: a second LLM class tries to refute prior confirmations; unrefuted paths graduate to confirmed vulnerabilities
Results: $20 for a single day across 5 open-source projects yielded 10 reported vulnerabilities (MEDIUM to CRITICAL), 4 already confirmed — 8 of the 10 were novel and undetected by CodeQL's published rules, only 2 overlapping.
More from coding & agent
- Tess creator open-sources fine-tuning recipe: turn Claude Code sessions into a local model — udmrzn · 2026-11-08
- AFK Pilot extension brings Grok, Claude, Codex, DeepSeek and more into one VS Code window — PawelHuryn · 2026-11-08
- ComfyUI workflow: MiniMax H4 Ripple with Pika Flex lets you edit one frame and change the whole video — Maleficent-Tell-2718 · 2026-11-08
- 17 open-source offensive AI security frameworks: Cairn hits 4.9k stars — evilsocket · 2026-11-08
- 'Find all the implicit state machines in my app' becomes a favorite AI prompt — rachittshah · 2026-11-08
- Claude Code sessions can message each other — demo shows agent-to-agent collaboration — dejanseo · 2026-11-08