Eugene Yan argues that improved model capabilities shift the bottleneck in code security from finding possible vulnerabilities to deciding which findings are real, important and safely fixable. He presents six stages: threat modeling, sandbox preparation, discovery, verification, triage and patching. The threat model supplies business context, while a reproducible sandbox provides isolation without production credentials or unrestricted access.
Eugene Yan illustrates the workflow with a hypothetical order service containing SQL injection. Discovery seeks high recall; a separate adversarial verification agent receives the finding without the discovery agent's reasoning and tries to disprove it or reproduce an exploit. Triage then accounts for severity, exposure, compensating controls and sensitive data rather than treating every technically valid finding as equally urgent.
Eugene Yan describes patch validation through a failing original exploit, passing existing tests and fresh attempts to attack the patched code, followed by human approval before merging. He also emphasizes organizational constraints: routing findings to owners, agreeing on severity definitions and scaling patch-review capacity. He recommends starting interactively with familiar code rather than assuming fully autonomous remediation.
Watch on YouTube
