A Technological Race in Code Security
In recent weeks, high-profile cases involving the AI models Claude Mythos and GPT-5.6-Sol have shown that artificial intelligence can independently find vulnerabilities in complex software and chain them together into working attack sequences. For the first time, this has made clear to the public that attackers could soon misuse this technology to run fully automated attacks — attacks that classical, manual security research simply can't keep up with.
That's exactly the problem we're tackling: for several months now, we at proofnet have been developing our own solution for automated, AI-powered vulnerability analysis of source code. In this post, we explain why we're taking this path, what our approach looks like, and where things currently stand.
Why Classical Tools Are Reaching Their Limits
Established scanners mostly rely on static pattern recognition. They're fast, but they also produce many false positives and are blind to anything that doesn't fit well-known patterns. Classical machine learning approaches like Graph Neural Networks haven't been able to close this gap either: they lack real code understanding, and their limited context window makes it hard to catch vulnerabilities that only become apparent across multiple functions or even multiple files.
The Answer: Agentic LLM Systems
Modern Large Language Models (LLMs) close this gap. They can process large amounts of code at once, have developed an intuitive understanding of code through training on code generation and debugging, and can be deployed as agents. In practice, that means LLMs can explore code interactively, form hypotheses about vulnerabilities, and then verify them — and they can be orchestrated much like human teams, working collaboratively across different expert roles, perspectives, and tools.
Anthropic and Google have both published and practically validated multi-stage, agentic pipelines for automated vulnerability analysis — further proof that this kind of system is state of the art.
Our Approach
Our system autonomously analyzes the entire codebase and, at the end of the process, delivers a prioritized list of potential vulnerabilities, including proof-of-concept scripts, for review by a human security expert. Importantly, our pipeline doesn't make any decisions itself — it just takes on the labor-intensive search and pre-sorting work. This saves valuable time in the audit process, makes security analysis more efficient, and enables faster responses to any vulnerabilities that are found.
What Makes the Difference
One of our most important findings: you don't need huge models or large compute clusters to get good results. With the right orchestration — a staged pipeline with complementary analysis steps — smaller, open-source models can be used successfully too. As a result, our system runs entirely on affordable, local consumer hardware, which means the highest possible level of protection for source code and confidential data. Depending on requirements, the pipeline can also scale up to more powerful cloud models, so the balance between performance, speed, and data protection can be flexibly configured for any use case.
Relevance for Compliance: Cyber Resilience Act
Regulatory pressure — especially from the EU's CRA — is increasingly requiring manufacturers to provide continuous, rather than one-time proof of their vulnerability management. Automated, repeatable source code analysis provides exactly the kind of ongoing, reproducible evidence the CRA will expect. Our pipeline complements our existing offering around automated firmware analysis, SBOM generation, and continuous CVE monitoring.
Where We Currently Stand
Our system is currently in the prototype phase and is being continuously tested and developed further on open-source projects. Recent improvements have already noticeably reduced the false-positive rate. In a pilot project, we were able to deploy the pipeline as part of a customer project, which boosted our efficiency during the audit.
In our tests, the system has already independently rediscovered several known, publicly documented vulnerabilities (CVEs). We've also come across potential previously unknown vulnerabilities, which we're currently working through carefully and, where appropriate, will bring into a responsible disclosure process with the affected projects.
What's Next
We're continuously expanding our system so we can eventually build it firmly into our security audits. Our goal is to make vulnerability analysis not just faster, but also more thorough and consistent than what's achievable with classical manual work.