--- title: Using LLMs to Secure Source Code — Eugene Yan, Anthropic description: An Anthropic engineer shares lessons from working with security teams to use LLMs for finding and fixing code vulnerabilities at scale. The talk outlines a... canonical: https://daily.dev/posts/using-llms-to-secure-source-code-eugene-yan-anthropic-oymkqa4i2 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Using LLMs to Secure Source Code — Eugene Yan, Anthropic | daily.dev og:description: An Anthropic engineer shares lessons from working with security teams to use LLMs for finding and fixing code vulnerabilities at scale. The talk outlines a... og:url: https://daily.dev/posts/using-llms-to-secure-source-code-eugene-yan-anthropic-oymkqa4i2 og:image: https://api.daily.dev/og/posts/OyMKqA4I2.png og:image:alt: Using LLMs to Secure Source Code — Eugene Yan, Anthropic og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Using LLMs to Secure Source Code — Eugene Yan, Anthropic **[AI Engineer](https://daily.dev/sources/aidotengineer)** · 21 min read · 1 upvotes · 0 comments ## Summary An Anthropic engineer shares lessons from working with security teams to use LLMs for finding and fixing code vulnerabilities at scale. The talk outlines a six-step agentic framework: threat modeling, sandboxing, discovery, verification, triage, and patching. Key insights include: frontier models have dramatically increased vulnerability discovery (Mozilla Firefox saw a 20x spike in fixes), but the bottleneck has shifted to verification, triage, and patching rather than finding bugs. Agentic harnesses with isolated sandboxes and proof-of-concept detonation dramatically reduce false positives. Organizational challenges like severity calibration and patch review bandwidth are harder to solve than the technical ones. Practical advice: start interactively with open-source dependencies, simplify prompts as models improve, and give agents tools to dynamically probe systems rather than just read code. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How much did Firefox's monthly security bug fix rate increase after using AI models to find vulnerabilities? Mozilla Firefox's average monthly security bug fixes in 2025 were around 20, but that jumped roughly 3x to 60-70 in February and March, then 7x to about 400 in April, a 20x increase over the prior year's average. Mozilla attributed about two-thirds of the April spike to a Claude preview model (referred to as version 271), showing frontier models can help defenders find and fix vulnerabilities at scale. _Engineers evaluating AI-assisted vulnerability scanning can track results like this on daily.dev._ ### What is the recommended workflow for using AI agents to find and fix security vulnerabilities in a codebase? Teams commonly converge on six steps: building a threat model, setting up an isolated sandbox, then a loop of discovery, verification, triage, and patching. Discovery optimizes for recall using context engineering, simpler prompts, and tool access; verification uses an independent, adversarial agent to confirm true positives; triage prioritizes high-impact, high-likelihood issues; patching validates fixes against re-attack before human merge. _Teams designing a vulnerability workflow can compare agentic security approaches like this on daily.dev._ ### Why does a well-documented threat model improve an AI model's ability to find real security vulnerabilities? A documented threat model raises the true positive rate to as high as 90%, because models understand code well but lack context about business decisions, compensating controls, or undocumented past fixes. Writing down system design rationale, known threat vectors, and internal-only access details gives the model context it cannot infer from code alone, improving both vulnerability coverage and precision. _Security engineers refining threat models for AI tooling can follow workflow breakdowns like this on daily.dev._ ## Similar posts on daily.dev - [Using LLMs to secure source code](https://daily.dev/posts/using-llms-to-secure-source-code-jhoalndg0) · Eugene Yan · 0 upvotes · 0 comments - [Parsing Agentic Offensive Security's Existential Threat](https://daily.dev/posts/parsing-agentic-offensive-security-s-existential-threat-m4nj9nots) · Dark Reading · 0 upvotes · 0 comments - [How to scan for vulnerabilities with GitHub Security Lab’s open source AI-powered framework](https://daily.dev/posts/how-to-scan-for-vulnerabilities-with-github-security-lab-s-open-source-ai-powered-framework-qezcyia5u) · GitHub Blog · 1 upvotes · 0 comments - [Securing the software factory at machine speed](https://daily.dev/posts/securing-the-software-factory-at-machine-speed-j44zhqrq7) · GitLab · 1 upvotes · 0 comments - [we are building data breach machines and nobody cares](https://daily.dev/posts/we-are-building-data-breach-machines-and-nobody-cares-qcskpagwt) · Hacker News · 3 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#llm](https://daily.dev/tags/llm), [#claude](https://daily.dev/tags/claude), [#agentic-ai](https://daily.dev/tags/agentic-ai) [View this post on daily.dev](https://daily.dev/posts/using-llms-to-secure-source-code-eugene-yan-anthropic-oymkqa4i2) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Using LLMs to Secure Source Code — Eugene Yan, Anthropic","url":"https://daily.dev/posts/using-llms-to-secure-source-code-eugene-yan-anthropic-oymkqa4i2","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/using-llms-to-secure-source-code-eugene-yan-anthropic-oymkqa4i2"},"datePublished":"2026-07-17T21:29:21.072Z","dateModified":"2026-09-14T07:38:24.091Z","description":"An Anthropic engineer shares lessons from working with security teams to use LLMs for finding and fixing code vulnerabilities at scale. The talk outlines a...","image":"https://i.ytimg.com/vi/imFedndyXYQ/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/imFedndyXYQ/sddefault.jpg","isAccessibleForFree":true,"articleSection":"AI Engineer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"AI Engineer","logo":"https://media.daily.dev/image/upload/s--u5PucxNT--/f_auto/v1724338940/logos/aidotengineer","url":"https://daily.dev/sources/aidotengineer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/using-llms-to-secure-source-code-eugene-yan-anthropic-oymkqa4i2","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,llm,claude,agentic-ai","timeRequired":"PT21M","video":{"@type":"VideoObject","name":"Using LLMs to Secure Source Code — Eugene Yan, Anthropic","description":"An Anthropic engineer shares lessons from working with security teams to use LLMs for finding and fixing code vulnerabilities at scale. The talk outlines a...","thumbnailUrl":"https://i.ytimg.com/vi/imFedndyXYQ/sddefault.jpg","uploadDate":"2026-07-17T21:29:21.072Z","duration":"PT21M","url":"https://api.daily.dev/r/OyMKqA4I2","embedUrl":"https://www.youtube.com/embed/imFedndyXYQ"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"AI Engineer","item":"https://daily.dev/sources/aidotengineer"},{"@type":"ListItem","position":3,"name":"Using LLMs to Secure Source Code — Eugene Yan, Anthropic"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/using-llms-to-secure-source-code-eugene-yan-anthropic-oymkqa4i2#faq","mainEntity":[{"@type":"Question","name":"How much did Firefox's monthly security bug fix rate increase after using AI models to find vulnerabilities?","acceptedAnswer":{"@type":"Answer","text":"Mozilla Firefox's average monthly security bug fixes in 2025 were around 20, but that jumped roughly 3x to 60-70 in February and March, then 7x to about 400 in April, a 20x increase over the prior year's average. Mozilla attributed about two-thirds of the April spike to a Claude preview model (referred to as version 271), showing frontier models can help defenders find and fix vulnerabilities at scale. Engineers evaluating AI-assisted vulnerability scanning can track results like this on daily.dev."}},{"@type":"Question","name":"What is the recommended workflow for using AI agents to find and fix security vulnerabilities in a codebase?","acceptedAnswer":{"@type":"Answer","text":"Teams commonly converge on six steps: building a threat model, setting up an isolated sandbox, then a loop of discovery, verification, triage, and patching. Discovery optimizes for recall using context engineering, simpler prompts, and tool access; verification uses an independent, adversarial agent to confirm true positives; triage prioritizes high-impact, high-likelihood issues; patching validates fixes against re-attack before human merge. Teams designing a vulnerability workflow can compare agentic security approaches like this on daily.dev."}},{"@type":"Question","name":"Why does a well-documented threat model improve an AI model's ability to find real security vulnerabilities?","acceptedAnswer":{"@type":"Answer","text":"A documented threat model raises the true positive rate to as high as 90%, because models understand code well but lack context about business decisions, compensating controls, or undocumented past fixes. Writing down system design rationale, known threat vectors, and internal-only access details gives the model context it cannot infer from code alone, improving both vulnerability coverage and precision. Security engineers refining threat models for AI tooling can follow workflow breakdowns like this on daily.dev."}}]} ```