Most teams treat coding agents as glorified line-level reviewers, but that completely misses their real leverage. The highest leverage use case for AI agents in security is building custom compilers, formal models, and analysis tools for targets that have zero developer tooling.
Trail of Bits demonstrated this approach while auditing the Miden virtual machine, a zero-knowledge execution environment with its own low-level assembly language. Rather than asking an LLM to find vulnerabilities directly in unfamiliar bytecode, the team spent six months using agents to synthesize a custom Language Server Protocol server, a decompiler, a static analysis engine, and a formal Lean specification of the executor from scratch.
This agent-constructed toolchain uncovered a severe vulnerability where an unvalidated prover input allowed forging Falcon signatures to steal funds. Furthermore, the Lean specification produced 95 machine-checked correctness proofs for the core library.
Do not ask agents to spot bugs in code they cannot execute; make them build the compilers and verifiers that do the hard work for you.

