{"slug": "how-xint-code-reads-a-large-codebase", "title": "How Xint Code Reads a Large Codebase", "summary": "Xint Code splits large-codebase vulnerability hunting across many parallel agents, each scoped to a small piece of code, rather than giving one model the whole repository. The approach targets a failure mode Xint Code observed when it examined seven frontier and open-weight models: in the logs of models that failed to find a target vulnerability, over 96% of tokens consumed went to re-reading the model's own earlier work, and more attempts meant repeating a wrong idea whether the model reasoned for 5 hours or 24 hours. Xint Code builds a threat model first, keeps each agent aware of how its piece connects to surrounding code, and requires flagged issues to be reproduced before reaching the customer.", "body_md": "# How Xint Code Reads a Large Codebase\n\nGive one AI model an entire repository and plenty of time, and it tends to circle. It rereads the same files, chases the same leads, and if it hasn't found something early, more hours rarely help. Bigger codebases make that worse, not better.\n\nWe recently examined seven frontier and open-weight models to understand the changing economics of finding a 0day. When we examined the logs of the models that failed to find the target vulnerability, we found that more attempts did not lead to models getting closer — it meant repeating a wrong idea. Whether it was 5 hours or 24 hours of reasoning, over 96% of tokens consumed by the failing models was the model re-reading its own earlier work with only a small percentage dedicated to new thinking.\n\nXint Code is built to avoid that. It doesn't ask one model to hold the whole codebase at once. It splits the work.\n\n## **Threat model first**\n\nBefore looking for bugs, Xint Code reads the project the way a security reviewer would: what the software does, who can reach it, what data it holds, and how it's typically deployed. That threat model is what every later step is judged against, so a finding counts only if it matters in a realistic deployment.\n\n## **Split the work**\n\nInstead of handing one model the entire repository, Xint Code breaks the code into small pieces and gives each piece its own agent, with many running in parallel. No single agent has to keep the whole codebase in view, so none of them end up going in circles.\n\n## **Keep the connections**\n\nThe pieces aren't analyzed in isolation. Each agent knows how its piece connects to the code around it, so a bug that only shows up across a boundary still gets caught.\n\n## **Prove it**\n\nAnything an agent flags is checked against the threat model and has to be reproduced. What reaches the customer is a vulnerability with reproduction steps, not a weakness someone has to chase down.\n\n## **What this means for a security team**\n\nCoverage holds up as codebases grow, because the work is split instead of stretched. And the findings are the ones that matter for how the software actually runs, each one with proof attached.", "url": "https://wpnews.pro/news/how-xint-code-reads-a-large-codebase", "canonical_source": "https://xint.io/blog/how-xint-code-reads-a-large-codebase-405613", "published_at": "2026-11-11 09:32:00+00:00", "updated_at": "2026-11-11 09:53:22.783385+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "artificial-intelligence"], "entities": ["Xint Code"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/how-xint-code-reads-a-large-codebase", "markdown": "https://wpnews.pro/news/how-xint-code-reads-a-large-codebase.md", "text": "https://wpnews.pro/news/how-xint-code-reads-a-large-codebase.txt", "jsonld": "https://wpnews.pro/news/how-xint-code-reads-a-large-codebase.jsonld"}}