# Detecting Insecure Software Updates at Scale with LLM Agents

> Source: <https://xusheng.dev/posts/reversing/detecting_insecure_software_updates_at_scale/main/>
> Published: 2026-09-16 00:00:00+00:00

## TL;DR

- I used a hierarchy of low-cost source-reading agents, stronger review agents, and manual verification to trace how **3,006 open-source projects** handle software updates.
- I found **624 with an updater** that could download and then install, load, or execute code: 134 used a pinned signing key, 109 enforced a publisher identity, 332 relied only on HTTPS, and**49 used broken transport security** . The other 2,382 had no updater or were notification-only.
- In those **49 projects** , a man-in-the-middle attacker could replace update payloads and achieve remote code execution on users’ machines.

Browse the [dataset](https://xusheng6.github.io/update-security-study/) or inspect and correct it in the [public repository](https://github.com/xusheng6/update-security-study).