eugeneyan
Ctrl P

AI Engineer 2026 - Using LLMs to Secure Source Code

1 min read llm cybersecurity engineering

I spoke at the AI Engineer World’s Fair 2026 in San Francisco on using LLMs to secure source code: why now, six steps to building your own agentic harness for security, and the org bottlenecks that show up once finding vulnerabilities gets easy.

Here are the slides. The AI Engineer talk page has the recording, chapters, and transcript, and the write-up has the field lessons behind the talk.

Title slide: Using LLMs to Secure Source Code, by Eugene Yan of Anthropic, at the AI Engineer World’s Fair 2026

What we’ll cover: why now, how to work with models for security and the potential bottlenecks, and how to get started

Section I: Why now. Three trends: model capability, vulns found, and a shifting bottleneck

Model capability on cyber tasks is doubling every ~5 months

Mozilla found more vulns in April 2026 than in all of 2025

Notable public vulns and exploits: Log4Shell and Heartbleed

The new bottleneck: from finding vulns to verifying, triaging, and patching them

Section II: Six simple steps to building your own agentic harness for security

Why this works now: agentic harnesses

The six steps: threat model and sandbox as setup, then discovery, verification, triage, and patching as a cycle

Running example: meet order-service

Threat model: decide what counts as a vuln before starting

Example: a threat model bootstrapped from the codebase

Sandbox: isolate the agent and make runs reproducible

Example: the sandbox holds the target stack, plus a security agent probing it

Discovery: rich context, shorter prompts, useful tools

Example: spot the vulnerability

Example: one vulnerability the discovery agent found, a SQL injection

Verification: independently confirm what’s exploitable

Example: the proof of concept successfully exfiltrates user data

Triage: dedupe by root cause, rank by preconditions

Example: compensating controls downgrade a finding from High to Low

Patching: fix, validate, hunt variants, close the loop

Example: patch the code, then close the loop on the threat model

What each of the six steps focuses on

Section III: Yet another bottleneck, org processes

What happens when you find one to two orders of magnitude more vulns?

Organizational bottlenecks you might hit, and what to do

Section IV: If you only remember one thing

Start now, and here’s how

Resources #