TLDR Tech / InfoSec
Local AI for Penetration Testing & Research
Four workflows are tested against a known PHPIPAM authenticated LFI issue: Semgrep, an agentic cloud setup with GLM 5.1, a cloud skill‑based review system, and a local model driven by a custom file‑by‑file harness. Semgrep and the agentic cloud run miss the bug. The skill‑based approach only catches it on some runs and shows how detection depends on which files are read and what patterns are searched. The local harness, walking each source file with structured reports, reliably finds the LFI and later uncovers an authenticated RCE in myVesta, now fixed as CVE‑2026‑12195.
Read the full story