Descriptions:
Eugene Yan, a member of technical staff at Anthropic, delivers a conference talk at AI Engineer on how large language models can be used to find and fix security vulnerabilities in source code at scale. Drawing on months of work with security teams and Claude, Yan presents data showing a dramatic acceleration in real-world vulnerability patching: Mozilla Firefox went from an average of roughly 20 security fixes per month in 2025 to over 400 in April 2026 — a 20x increase — with approximately two-thirds attributed to Claude’s preview model. Anthropic’s own internal scanning of more than 1,000 open-source repositories identified 6,200 high or critical vulnerabilities, of which 1,600 were reported to maintainers and about 100 patched upstream.
The core framework Yan presents is a six-step agentic harness: building a threat model for the target codebase, creating an isolated sandbox where the model can detonate proof-of-concept exploits, then running discovery, verification, triage, and patching phases. He emphasizes that the bottleneck has shifted from finding vulnerabilities — which current frontier models handle readily — to verification and triage, where sandboxed live environments that let models confirm true positives are the highest-leverage investment.
Practical guidance includes using context engineering to reduce false positives, simplifying prompts as models improve (Yan notes cutting prompt length by ~50% with each model generation step-jump), and equipping models with real tools — API query, log reading, source inspection — rather than asking them to reason purely from static code. Teams that gave models this tooling achieved near-100% true positive rates.
📺 Source: AI Engineer · Published July 17, 2026
🏷️ Format: Keynote Launch
