LLM-Assisted Code Review Finds Vulnerabilities at a Fraction of the Cost
A recent security review using Large Language Models (LLMs) has demonstrated that thorough code analysis can be achieved at a significantly lower cost than previously thought. The review, conducted on GlobaLeaks, a mature whistleblowing platform with a history of rigorous auditing, identified 29 confirmed vulnerabilities and 12 denial-of-service issues in just one pass through the codebase.
The most striking aspect of this exercise is its affordability. With an estimated total cost of around $3,140 for API calls, the review was able to pinpoint weaknesses that would have traditionally required weeks of specialist work and a substantial budget. This shift in economics changes the landscape for defenders, making it possible for more entities to engage in thorough code analysis.
The distinction between who can afford this kind of analysis is no longer as clear-cut as it once was. Historically, only a small group with specialized skills could undertake such an exercise, pricing out casual adversaries and leaving them at a disadvantage. However, the advent of commercial LLMs has altered this dynamic, making thorough code reading more accessible to a wider range of actors.
The review itself was not conducted on neglected software but rather during an intensive hardening cycle when maintainers had made 183 commits in just one month. This is significant because findings uncovered at such moments carry greater weight than those discovered in stale or abandoned codebases, providing a clearer signal about the system’s overall security posture.
The distribution of costs across different LLM models was also noteworthy. One high-reasoning model accounted for approximately 61.9% of total spend despite processing only around 90 million tokens out of over 1.24 billion used in the campaign. Cheaper models, on the other hand, handled most of the broad reading volume at a significantly lower cost.
This disparity highlights that deeper reasoning capabilities come with a higher price tag but no longer act as an insurmountable barrier to entry. The capability is real and, by any motivated adversary’s standards, inexpensive according to GlobaLeaks. This assertion underscores the potential for LLMs to streamline code analysis without replacing expert judgment.
The review produced 110 triaged records in total: 29 confirmed vulnerabilities, 12 denial-of-service findings, 42 hardening recommendations, and 27 retained non-findings kept for transparency. The inclusion of these latter items is crucial as it demonstrates not only what was found but also what was considered and later set aside. This approach presents a healthier view of LLM-assisted research than assuming every model output holds equal weight.
Some of the most significant findings were surprisingly mundane, involving session-to-account takeover paths, whistleblower anonymity risks, tenant-boundary weaknesses, missing audit trails for sensitive actions, and availability problems triggered by a single unauthenticated user. These issues are precisely what make the result uncomfortable: the value of LLM-assisted analysis lies not in discovering exotic bugs but in making broad, systematic reading affordable enough to be repeated at scale.
The report is careful not to overstate the capabilities of machine learning models. Every candidate produced by the models was treated as a hypothesis until human reviewers validated it through code tracing and assessed its practical impact. The LLM reduced the cost of looking but did not replace expert judgment, emphasizing that thorough analysis still requires human oversight.
The takeaway for teams building or defending critical software is clear: no longer can they assume that thorough code reading is too expensive for most adversaries due to commercial LLMs changing this equation. A practical response would be continuous hardening, disciplined review, and the assumption that the next entity reading the code may indeed be cheaper, faster, and more patient than the last.