Software projects now commonly run AI vulnerability discovery tools, also called harnesses, that wrap a large language model (LLM) around a series of fixed steps. The harnesses select files from a repository, send the code to the model to look for security flaws, and then collect and report any problems the model identifies. The model itself does not choose which files to open or decide which results to keep. Ordinary program code makes those decisions to control cost and reduce false alarms.[1]
