Using LLMs to Secure Source Code — Eugene Yan, Anthropic
Jul 17, 2026 · 21:30
Eugene Yan of Anthropic details how frontier LLMs like Claude are reshaping software security, citing Mozilla's 20x surge in monthly fixes (to 400 in April 2025, two-thirds credited to Claude) and Anthropic's own scan of 1,000+ open source repos that uncovered 6,200 high/critical issues, 1,600 reported, and about 100 patched upstream. He argues that finding vulnerabilities is no longer the hard part; the bottleneck has moved to verification, triage, and patching. Yan outlines a six-step workflow: a written threat model (boosts true positive rate to 90%), an isolated sandbox for reproducibility, discovery optimizing for recall, a separate adversarial verification agent that detonates exploits in fresh containers, triage to prioritize engineer attention, and patching that closes the loop so bugs cannot recur. His advice: start this week on open source dependencies, keep hands on the wheel before automating, and recognize that scanning was never the bottleneck.
