Researchers automated Java deserialization gadget chain discovery using LLM-driven analysis combined with static call graph analysis, discovering novel chains against WildFly and other application servers. The methodology uses WALA-based call graph construction, dynamic bytecode analysis for type confusion, and Claude Code to iteratively explore and validate gadget chains through a REST API query interface.
Part 2 of a security benchmark study comparing LLM-based security scanners (Neo, Claude Code) against traditional SAST/DAST tools on AI-generated code, finding that Neo detects more true positives with fewer false positives by validating findings against running applications.
Analysis of Claude's security scanning capabilities and its limitations in detecting vulnerabilities, with discussion of market implications for existing SaaS security vendors.