Seems to help attackers just as much as defenders though, until you’ve found every single bug (which could be possible, but will likely be expensive.)
Why would you expect that? LLMs are explicitly trained on what humans do. Humans miss security vulnerabilities all the time.
Because the LLM based appsec products I've tested on a large code base have been very good at finding what devs and appsec code reviews didn't.
Which ones, out of curiosity?
Humans can't be forced to evaluate every piece of code 100000 times in an hour. LLMs can.
With infinite hardware, sure. LLMs are pretty expensive to run vs fuzzing.
Humans find security vulnerabilities all the time too. The assumption is a lot of the misses are because highly trained security experts don't have time to carefully read and understand all code without fatigue.