Listen to this Post
Introduction: The New Era of Affordable Code Auditing
For years, deep security audits were considered a privilege reserved for large organizations with significant budgets. Reviewing millions of lines of source code manually required teams of experienced security researchers, weeks or even months of effort, and financial resources that smaller projects often could not afford.
That assumption is now being challenged.
A recent security review of GlobaLeaks, a mature whistleblowing platform trusted for privacy-sensitive communication, demonstrated how artificial intelligence is changing the economics of vulnerability discovery. Using large language models (LLMs), researchers conducted a deep code analysis that cost approximately $3,140 in API usage and uncovered dozens of security weaknesses.
The results are both promising and alarming. AI did not replace cybersecurity experts, but it dramatically reduced the cost of finding potential problems. What once required expensive human labor can now be assisted by machines capable of reading, analyzing, and questioning enormous codebases at unprecedented speed.
The message for developers and defenders is clear: the barrier protecting software from attackers is becoming smaller.
A $3,140 AI Security Audit Finds 29 Vulnerabilities in GlobaLeaks
A Mature Project Put Under the Microscope
GlobaLeaks was not an abandoned or poorly maintained project. According to the security report, the platform had already completed six independent professional security audits over thirteen years.
The project was actively maintained, with developers pushing 183 commits in the month before the reviewed version. These updates included important security improvements such as:
Token hashing improvements
Session-state protection changes
Stronger authorization controls
Additional audit logging mechanisms
This makes the findings more significant. The AI-assisted review was not searching through neglected software filled with obvious mistakes. It examined a project that had already received serious security attention.
The discovery shows that even mature applications with experienced developers can contain hidden weaknesses.
Artificial Intelligence Is Reducing the Cost of Finding Bugs
The Economics of Security Research Are Changing
Traditional code auditing has always been limited by time and money.
A security researcher manually examining a large application must understand:
The architecture
Authentication flows
Permission systems
Data handling
Business logic
Potential attack paths
This process can take weeks or months.
The GlobaLeaks experiment demonstrated a different reality. AI models were able to analyze massive amounts of code at a relatively low cost.
The review consumed approximately 1.24 billion tokens, yet the total API expense remained around $3,140.
The average cost per confirmed vulnerability was estimated at roughly $77 before human validation.
This changes the security landscape because the ability to perform detailed code analysis is no longer restricted only to wealthy organizations.
The Real Threat: Attackers Can Also Use These Tools
Security Knowledge Is Becoming More Accessible
For decades, complex vulnerability research acted as a natural barrier.
Finding subtle security flaws required:
Advanced programming skills
Years of experience
Specialized knowledge
Significant time investment
That barrier discouraged many potential attackers.
However, AI-assisted analysis changes this equation.
The same technology that helps defenders discover vulnerabilities can also help attackers identify weaknesses faster.
The report highlighted an uncomfortable reality:
A motivated adversary does not need a huge budget anymore to perform patient and systematic code review.
A criminal group with access to commercial AI models may now analyze open-source software, search for authentication flaws, and identify overlooked weaknesses at a fraction of the traditional cost.
What The AI Review Discovered Inside GlobaLeaks
110 Security Records Were Examined
The LLM-assisted campaign produced 110 total triaged records.
The results included:
29 confirmed vulnerabilities
12 denial-of-service issues
42 security hardening recommendations
27 rejected findings preserved as non-findings
This approach is important because it demonstrates responsible AI security research.
Many AI-generated security reports contain false positives. Instead of presenting every suggestion as a vulnerability, researchers verified each result through human review.
The process showed that AI can dramatically expand security testing, but human expertise remains essential.
The Most Serious Issues Were Ordinary Security Mistakes
Common Errors Remain The Biggest Danger
One of the most interesting aspects of the research was that the AI did not discover impossible-to-find theoretical attacks.
The vulnerabilities were mostly caused by common development mistakes.
Examples included:
Session management weaknesses
Possible account takeover paths
Risks to whistleblower anonymity
Tenant separation problems
Missing audit records
Availability issues triggered by unauthenticated users
These problems are not unusual.
They represent the everyday mistakes that appear in almost every large software project.
A single forgotten authorization check or missing security log can become a serious vulnerability when attackers discover it.
Deep Analysis: How Security Teams Can Apply AI-Assisted Code Review
Preparing a Codebase for AI Security Analysis
Security teams can combine traditional testing with AI-assisted analysis.
Example workflow:
git clone https://github.com/example/project.git cd project
Review project structure
find . -type f | grep -E ".(js|py|php|java|go)$"
Search authentication-related code
grep -R login\|session\|token\|password .
Identify permission checks
grep -R authorize\|permission\|role\|admin .
AI systems can then help researchers examine:
Authentication logic
Access control rules
Input validation
Database operations
Cryptographic usage
Automated Security Scanning Pipeline
A modern defensive workflow could include:
Static analysis example
semgrep –config auto .
Dependency vulnerability check
npm audit
Python package scanning
pip-audit
Container security scanning
trivy image application-name
AI can assist by explaining findings, prioritizing risks, and suggesting remediation strategies.
However, security professionals must still validate:
Exploitability
Business impact
Real attack scenarios
Example AI Security Review Questions
Security teams can ask AI systems:
Analyze this authentication module.
Find:
1. Possible privilege escalation paths
2. Missing authorization checks
3. Session handling weaknesses
4. Data leakage risks
5. Race conditions
Another example:
Review this API endpoint.
Determine:
– Can unauthorized users access resources?
– Are identifiers predictable?
– Are logs sufficient for investigation?
– Can attackers abuse this feature?
AI works best as an additional researcher, not as a replacement for security experts.
The Human Expert Remains The Final Security Layer
AI Finds Possibilities, Humans Confirm Reality
The GlobaLeaks research carefully avoided claiming that machines can replace cybersecurity professionals.
Every AI-generated discovery required human validation.
Researchers needed to:
Understand the code context
Reproduce issues
Confirm security impact
Separate real vulnerabilities from false alarms
This distinction is critical.
AI can read faster.
AI can search wider.
AI can identify patterns.
But understanding whether a flaw creates a real-world security threat still requires human judgment.
The Future of Software Security Has Changed
Continuous Security Will Become Necessary
The traditional security model often looked like this:
Build software
Perform occasional audits
Release updates
Repeat
That approach may no longer be enough.
As AI makes vulnerability discovery cheaper, attackers can continuously analyze software.
Defenders will need:
Continuous code review
Automated security testing
Faster patch cycles
Better logging
Stronger access controls
Security cannot be treated as a final inspection step anymore.
It must become a permanent process.
What Undercode Say:
AI Has Turned Code Reading Into A Scalable Weapon
The GlobaLeaks experiment represents a major shift in cybersecurity.
For decades, the biggest limitation in vulnerability research was human time.
The amount of software created every year exceeded the ability of security experts to manually inspect everything.
AI changes this equation.
A machine does not become tired after reading thousands of files.
It can compare patterns across huge codebases.
It can search for missing checks repeatedly.
It can analyze relationships between different components.
The most important discovery is not the vulnerabilities themselves.
The real discovery is that deep security analysis is becoming affordable.
This creates both opportunities and risks.
Security teams can now review applications more frequently.
Small open-source projects can access capabilities previously available only to major corporations.
Independent developers can improve security without spending enormous amounts of money.
However, attackers gain the same advantage.
The cybersecurity industry has entered a new competition.
The question is no longer who can read the code.
The question is who can analyze it faster.
AI-assisted hacking will likely increase the number of vulnerability discoveries.
Organizations that rely on security through obscurity will struggle.
Open-source projects must assume that attackers can examine their code efficiently.
Companies must move from periodic security reviews toward continuous monitoring.
Another important lesson is that ordinary mistakes remain dangerous.
Many developers imagine major cyberattacks require sophisticated techniques.
In reality, most breaches still begin with simple failures.
A forgotten permission check.
A missing security log.
A weak session system.
A poorly protected identifier.
AI does not need to discover impossible vulnerabilities.
It only needs to discover the thousands of small mistakes hidden inside modern applications.
The future belongs to organizations that combine human expertise with machine assistance.
AI should become another layer of defense.
But organizations must remember that every defensive tool can also become an offensive tool.
The cybersecurity race is accelerating.
The cost of finding vulnerabilities is falling.
The responsibility of fixing them is increasing.
Prediction
(+1) AI-Based Security Auditing Will Become Standard Practice 🚀
AI-assisted security reviews are likely to become a normal part of software development.
Companies will integrate LLM analysis into development pipelines, continuous integration systems, and vulnerability management platforms.
Open-source projects may benefit greatly because AI can provide affordable security assistance that was previously unavailable.
(-1) Attackers Will Discover More Vulnerabilities Faster ⚠️
The same technology will also lower the barrier for malicious actors.
Attack groups may use AI tools to analyze public code repositories, identify weaknesses, and automate reconnaissance.
Organizations that delay security improvements may face increasing risks.
✅ Confirmed: The GlobaLeaks security review used LLM-assisted analysis and identified dozens of confirmed vulnerabilities after human validation.
✅ Confirmed: The research demonstrated that AI-assisted code review can reduce the financial cost of large-scale security analysis.
❌ False assumption: AI has not replaced cybersecurity experts. Human researchers were still required to verify findings and determine real-world impact.
▶️ Related Video (76% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: securityaffairs.com
Extra Source Hub (Possible Sources for article):
https://www.twitter.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
