Unlike traditional SAST, code scanners or pen testers, Xint Code uses multi-LLM reasoning and orchestration for human-like contextual understanding, identification and prioritization of hidden vulnerabilities in large-scale application codebases

AUSTIN, Texas: Theori, a leader in offensive security research, today announced the commercial availability of Xint Code, the first completely LLM-native Static Application Security Testing (SAST) tool capable of analyzing millions of lines of source code, configuration files and binaries in less than 12 hours. This is the same award-winning technology used by the team that won at ZeroDay Cloud, placed top-3 at DARPA’s AIxCC challenge, and won a record 9 titles at DEF CON CTF.

Xint Code’s unique approach to deep scanning and contextual analysis of massive codebases helps application security teams quickly identify, reproduce, validate and understand the real-world critical vulnerabilities in applications. It uses LLMs combined with a proprietary orchestration engine to scan and analyze each line of code from a context and business logic perspective. This dramatically reduces false positives and helps defenders quickly prioritize the vulnerabilities that matter.

Attackers are increasingly using AI to surface critical vulnerabilities and security teams are struggling to stay one step ahead. Traditional SAST solutions can find known software vulnerabilities but also produce a high rate of false positives and trivial findings. Human penetration testers can find more subtle business context vulnerabilities that are often exploited by attackers (like ecommerce carts allowing negative item quantities), but can’t do so at scale. Generally available AI coding assistants have context and attention window limits that prevent them from scanning entire codebases and prioritizing their results. Xint Code solves all three problems, offering human-level insight at machine-level speed and scale.

In a new research report also released today, Theori shows how Xint Code was used to identify a severe vulnerability that enabled data exfiltration and arbitrary code injection that had been undetected for over two decades in the popular PostgreSQL open source project (which powers transactional and analytical workloads across SaaS, finance, telecom, and government deployments). The report explains why traditional SAST tools, human pen testers, and even next-gen AI tools missed this vulnerability, and how both attackers and defenders can now scan millions of lines of code in just a few hours to find critical vulnerabilities in massive, legacy code bases.

Xint is currently working with popular project maintainers, governments, and companies (including MongoDB, Fortune 10 companies, manufacturing giants, and global retailers) to analyze massive legacy codebases. Download the research report here – https://go.xint.io/xint_oss_research_paper_gate.

“Critical vulnerabilities often stay hidden because traditional scanners miss business logic flaws and manual reviews can’t scale across hundreds of millions of lines of code,” said Andrew Wesie, co-founder and CTO at Theori. “But LLMs are changing this. What would take pen testers weeks or months to find - if they know what to look for - Xint Code surfaces in hours. And it doesn't just flag potential issues; it tells you exactly how an attacker would trigger the exploit and what the impact is.”

Key capabilities of Xint Code include:

• Human-level Insight into Business Logic Vulnerabilities – Orchestrates multiple AI models to analyze code with contextual understanding, finding business logic flaws that traditional scanners miss entirely.
• Signals Over Noise – A multi-stage analysis pipeline verifies the severity and exploitability of every vulnerability before reporting, dramatically reducing false positives that drain security teams.
• Trigger and Impact Narratives – Every finding includes step-by-step reproduction instructions and real-world impact assessment, so teams can prioritize the vulnerabilities that actually matter.
• Zero Friction Deployment – Upload a repo and start scanning. No formatting, packaging or harness configuration required.

For more information on Xint Code, visit https://xint.io/. Or visit us at the RSA Conference on March 23-26, 2026, at booth S-2436.

About Theori

Founded in 2016 by Carnegie Mellon University alumni Brian Sejoon Pak (CEO) and Andrew Wesie (CTO), Theori has been a trailblazer in the cybersecurity industry, with over 160 successful consulting projects with tech giants such as Google, Microsoft, Samsung Electronics, and more. Based in Austin, Texas, and Seoul, South Korea, Theori provides automated cybersecurity solutions for both traditional and Web3 environments, as well as working to cultivate innovation within the cybersecurity field by training white hat hackers and promoting cybersecurity awareness.

Fonte: Business Wire