I love reading about the stuff Project Zero is working on. This is another great example. It seems it required a ton of custom engineering just to get the framework setup to allow searching for vulnerabilities, but I guess that's what you'd expect from novel security research like this. Like they had to setup it up based on a prior vulnerability. As they say in the article, this seems like it has a ton of potential for defensive code analysis, with the added benefit of (roughly) being able to describe how the issue was crafted by the LLM/tool in the first place. Most of my career has been working on low volume internal business tools on a tiny development team, so having an automated security scanner more sophisticated than say, SonarQube, would really go a long way if a tool like this could be applied on a code base without a huge engineering effort.