This is the use case that makes the most sense to me. Security auditing requires patience and thoroughness that maps perfectly to LLMs with long context windows.

The interesting part is the scale: hundreds of repos scanned automatically, each getting the kind of deep analysis that would take a human auditor days. And the vulns are real, not theoretical.

The next step is obvious: automated patching. Find the vuln, generate the fix, submit the PR. Some bounty platforms already pay for this. The economics only make sense at scale though, which is exactly where agents excel.

Part of tipping the scales toward defenders means doing the work ourselves.

I like that they're doing this. But despite Anthropic doing a lot of stuff right, I am awaiting the disappointment.