A recent security audit of the GlobaLeaks whistleblowing platform, assisted by large language models (LLMs), uncovered 29 confirmed vulnerabilities, 12 denial-of-service issues, and 42 hardening recommendations. This review, which cost approximately $3,140 in API calls, suggests that LLM-assisted code analysis can significantly reduce the cost and time associated with large-scale security assessments, making such capabilities more accessible to a broader range of actors, including potential adversaries.
The GlobaLeaks platform is a mature project with a 13-year history, having undergone six prior professional security audits. The LLM-assisted review was conducted on a codebase that had seen 183 commits in the month prior to the snapshot, indicating active development and hardening efforts, including token hashing, session-state resets, tighter authorization, and new audit logging. The discovery of vulnerabilities in such a actively maintained project highlights the efficacy of the LLM approach.
The cost distribution across different LLM models was notable. A high-reasoning model, while accounting for 61.9% of the total expenditure, processed only about 90 million of the 1.24 billion tokens used in the campaign. Cheaper models handled the majority of the broad code reading. This indicates that while deeper reasoning remains more expensive, the overall cost for comprehensive analysis has become substantially lower. The average cost per confirmed finding, before human validation, was approximately $77.
The audit produced a total of 110 triaged records, which included the confirmed vulnerabilities, denial-of-service findings, and hardening recommendations, alongside 27 retained non-findings kept for transparency. This approach of documenting both findings and considered-but-discarded outputs provides a more complete picture of the LLM-assisted research process.
The identified vulnerabilities were not exotic or novel cryptographic breaks. Instead, they comprised common issues such as session-to-account takeover paths, risks to whistleblower anonymity, tenant-boundary weaknesses, missing audit trails for sensitive actions, and availability problems triggerable by a single unauthenticated user. These are the types of "small, individually forgivable mistakes" that accumulate in large codebases and are often missed by traditional auditing methods.
A critical aspect of the LLM-assisted process was the role of human expertise. Every candidate vulnerability identified by the models was treated as a hypothesis and required human review to trace through the code, reproduce the issue, and assess its practical impact. The LLMs reduced the cost of initial investigation, but human judgment remained indispensable for validating findings and separating real vulnerabilities from plausible-looking noise.
The findings suggest a shift in the landscape of software security. The traditional assumption that thorough code reading is too expensive for most adversaries may no longer hold true, as commercial LLMs have altered the cost equation. For teams developing or defending critical software, the practical implications point towards continuous hardening, disciplined review processes, and the expectation that future code analysis, potentially by adversaries, will be cheaper, faster, and more patient.
