Foundry in the real world: Turning LLM hunches into verified findings – Security Loop Series, Part 2

Part 1 of this series ended with a star. Cisco’s Antares-1B, running on my laptop, points a beam into a repository and says “look here”, and roughly one time in three it’s pointing at the right file. Cheap, private, fast. It also ended with an uncomfortable truth: “look here” is not “this is real”. That gap is not a rounding error. It is the entire distance between a demo and a security program. And it’s not a gap that a bigger model closes on its own. Ask the best LLM you can buy to “find the vulnerabilities in this code” and you’ll get a confident, well-formatted answer. What you won’t get is any way to know which of those claims were checked, whether you’ll get the same answer next Tuesday, or why a given finding exists six months from now when an auditor asks. So this post is about the forge. I took the Foundry security harness specification, a design document Cisco published (not a tool), built a working implementation of it, and then did the thing that matters: I pointed it at real code. Not a toy app with planted bugs. Two large, popular AI/ML platforms, an OWASP training…