ISGroup says LLM study found 29 vulnerabilities in GlobaLeaks code
ISGroup says its LLM-based security study on GlobaLeaks processed about 1.24 billion tokens and produced findings that were later validated by researchers.
The Verona, Italy-based cybersecurity company ISGroup said on July 31, 2026, that it published a study on how large language models can be used to find weaknesses in source code.
The study, titled What Can an Attacker Find With an LLM?, focused on GlobaLeaks, an open-source whistleblowing platform used to protect sources and whistleblowers. ISGroup said the project suggests AI tools can help security teams review more code, but only when specialists check every output.
What the study found
According to ISGroup, the analysis used models from Anthropic and OpenAI and included human validation. The company said the work processed about 1.24 billion tokens through 12,000 model requests and generated 110 candidates for review.
ISGroup said researchers manually triaged all 110 candidates. After that review, the company said it confirmed 29 vulnerabilities, identified 12 denial-of-service issues and recorded 42 hardening observations. It said every model output was treated as a hypothesis that still needed verification.
Why it matters
ISGroup said the study shows frontier models can expand the amount of code a team can analyze and reduce cost. At the same time, the company said the method has limits, including false positives, non-deterministic results and the need for rigorous human validation.
The findings are relevant to GlobaLeaks because the platform is used by news organizations, companies and public administrations to protect sources and whistleblowers. ISGroup said the project builds on a system that has been developed over more than a decade and previously reviewed in independent security audits.
What ISGroup said
Francesco Ongaro, the company’s founder, said AI does not replace specialist expertise. He said it increases the amount of code a team can analyze and reduces the cost, while experts still have the decisive role in separating a plausible hypothesis from a real vulnerability.
ISGroup also said it shared all findings with the GlobaLeaks developers before publication, and that the most critical issues were addressed.
What happens next
ISGroup said the full report is available on its website and that Ongaro is available for interviews and technical briefings.
Sources
- GlobeNewswire press release: “What Can an Attacker Find With an LLM? ISGroup Publishes a Large-Scale Study”
- ISGroup company website: LLM-based code security review
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
Comments ()