# AI Engineer 2026 - Using LLMs to Secure Source Code > Why now, six steps to an agentic harness for security, and the org bottlenecks that follow. - Author: Eugene Yan - Published: 2026-06-30 - Tags: llm, cybersecurity, engineering - URL: https://eugeneyan.com/speaking/aie-2026 I spoke at the AI Engineer World's Fair 2026 in San Francisco on using LLMs to secure source code: why now, six steps to building your own agentic harness for security, and the org bottlenecks that show up once finding vulnerabilities gets easy. Here are the slides. The [AI Engineer talk page](https://ai.engineer/talks/imFedndyXYQ-using-llms-secure-source-code) has the recording, chapters, and transcript, and the [write-up](https://claude.com/blog/using-llms-to-secure-source-code) has the field lessons behind the talk. ![Title slide: Using LLMs to Secure Source Code, by Eugene Yan of Anthropic, at the AI Engineer World's Fair 2026](https://eugeneyan.com/assets/aie-2026-01.png) ![What we'll cover: why now, how to work with models for security and the potential bottlenecks, and how to get started](https://eugeneyan.com/assets/aie-2026-02.png) ![Section I: Why now. Three trends: model capability, vulns found, and a shifting bottleneck](https://eugeneyan.com/assets/aie-2026-03.png) ![Model capability on cyber tasks is doubling every ~5 months](https://eugeneyan.com/assets/aie-2026-04.png) ![Mozilla found more vulns in April 2026 than in all of 2025](https://eugeneyan.com/assets/aie-2026-05.png) ![Notable public vulns and exploits: Log4Shell and Heartbleed](https://eugeneyan.com/assets/aie-2026-06.png) ![The new bottleneck: from finding vulns to verifying, triaging, and patching them](https://eugeneyan.com/assets/aie-2026-07.png) ![Section II: Six simple steps to building your own agentic harness for security](https://eugeneyan.com/assets/aie-2026-08.png) ![Why this works now: agentic harnesses](https://eugeneyan.com/assets/aie-2026-09.png) ![The six steps: threat model and sandbox as setup, then discovery, verification, triage, and patching as a cycle](https://eugeneyan.com/assets/aie-2026-10.png) ![Running example: meet order-service](https://eugeneyan.com/assets/aie-2026-11.png) ![Threat model: decide what counts as a vuln before starting](https://eugeneyan.com/assets/aie-2026-12.png) ![Example: a threat model bootstrapped from the codebase](https://eugeneyan.com/assets/aie-2026-13.png) ![Sandbox: isolate the agent and make runs reproducible](https://eugeneyan.com/assets/aie-2026-14.png) ![Example: the sandbox holds the target stack, plus a security agent probing it](https://eugeneyan.com/assets/aie-2026-15.png) ![Discovery: rich context, shorter prompts, useful tools](https://eugeneyan.com/assets/aie-2026-16.png) ![Example: spot the vulnerability](https://eugeneyan.com/assets/aie-2026-17.png) ![Example: one vulnerability the discovery agent found, a SQL injection](https://eugeneyan.com/assets/aie-2026-18.png) ![Verification: independently confirm what's exploitable](https://eugeneyan.com/assets/aie-2026-19.png) ![Example: the proof of concept successfully exfiltrates user data](https://eugeneyan.com/assets/aie-2026-20.png) ![Triage: dedupe by root cause, rank by preconditions](https://eugeneyan.com/assets/aie-2026-21.png) ![Example: compensating controls downgrade a finding from High to Low](https://eugeneyan.com/assets/aie-2026-22.png) ![Patching: fix, validate, hunt variants, close the loop](https://eugeneyan.com/assets/aie-2026-23.png) ![Example: patch the code, then close the loop on the threat model](https://eugeneyan.com/assets/aie-2026-24.png) ![What each of the six steps focuses on](https://eugeneyan.com/assets/aie-2026-25.png) ![Section III: Yet another bottleneck, org processes](https://eugeneyan.com/assets/aie-2026-26.png) ![What happens when you find one to two orders of magnitude more vulns?](https://eugeneyan.com/assets/aie-2026-27.png) ![Organizational bottlenecks you might hit, and what to do](https://eugeneyan.com/assets/aie-2026-28.png) ![Section IV: If you only remember one thing](https://eugeneyan.com/assets/aie-2026-29.png) ![Start now, and here's how](https://eugeneyan.com/assets/aie-2026-30.png) ## Resources - [Claude Security](https://claude.com/product/claude-security): scans your codebase, validates findings, and suggests patches - [Using LLMs to secure source code](https://claude.com/blog/using-llms-to-secure-source-code): field lessons from teams running this in production - [defending-code-reference-harness](https://github.com/anthropics/defending-code-reference-harness): interactive skills and an autonomous harness - [claude-code-security-review](https://github.com/anthropics/claude-code-security-review): a GitHub Action for AI security review on pull requests