You're three days into a five-day whitebox engagement, the client's repo is bigger than anyone budgeted review time for, and someone on the team suggests the obvious shortcut: paste the whole codebase into an LLM and ask it to find the vulnerabilities. It sounds like exactly what a deadline like this needs.
The output looks convincing at first, a numbered list of findings with file paths and explanations attached to each one. Then you start verifying them one at a time, and most of the list falls apart: some reference code that's already sanitized, some describe a vulnerability class the framework doesn't even allow, a couple cite a line that says something different from what the finding claims. You've now spent longer chasing the list down than you would have spent reading the code cold.
The failure isn't the tool, it's the prompt. "Find the vulnerabilities in this codebase" asks a language model to hold thousands of lines of cross-referenced logic in working memory and reason about data flow across all of it at once, with nothing to ground the answer in except pattern-matching against what vulnerable code has tended to look like elsewhere. That's exactly the setup that produces confident, plausible-sounding findings that are wrong.
What actually works is doing the recon the same way you would without AI, then bringing the model in once you already have a lead. Grep the codebase yourself first, for raw SQL string formatting, subprocess calls, deserialization, template rendering with untrusted input, whatever's relevant to the stack in front of you. When something looks suspicious, that's when the model earns its keep: hand it the one function, the caller that reaches it, and a specific question, does user-controlled input from this request parameter reach this query unsanitized across this exact call path. That's a question with a checkable answer, not an open-ended audit.
Every answer stays a hypothesis, never a finding. If it says yes, you still trace it by hand before it goes anywhere near a report, because the model has no way to know if that input got validated three files upstream in a decorator it never saw. If it says no, that's not clearance either, you weren't asking it to find bugs on its own, you were asking it to help you look faster at a lead you already had a specific reason to chase.
That's the actual shape of AI inside a pentest workflow: not a scanner with better copy, a way to move faster through recon, code review and report drafting once you already know roughly what you're looking for. The AI for Penetration Testing Book: Red Team Workflows walks through that scoped approach across a full engagement, recon through reporting, not just the code review step above.
Top comments (0)