The AI Said the Endpoint Was Vulnerable. It Was Wrong.

说明与用途

LLM加速代码审计，但可能因缺乏上下文而产生误报。每个被标记的漏洞都需要人工验证。

问题

Using an LLM to review code in isolated chunks can produce false positives because the model lacks a persistent view of the entire call graph.

结果

The LLM accelerated the review process but produced false positives; manual verification was essential to ensure accurate findings.

工作流

• Paste batches of code into the LLM overnight
• Receive a ranked list of likely vulnerable functions
• Identify flagged items (e.g., SSRF)
• Manually verify each flagged item by tracing call paths and reproducing behavior
• Cross‑check any CVE IDs, version strings, or CVSS scores against real advisories
• Incorporate only verified findings into the final report

证据

By morning there's a ranked list: twelve "likely vulnerable" functions, one flagged in bold as SSRF via a URL parameter passed straight into an internal HTTP client. It reads like a finding. It's already in the report draft.

来源

The workflow that actually holds up treats the model as a hypothesis generator, never as the tester of record.

来源