# LLMs Are Not Security Mitigations

DevFeed: [LLMs Are Not Security Mitigations](<https://devfeed.tech/articles/llms-are-not-security-mitigations-33460.md>)

Original publisher: [Read original article](<https://timkellogg.me/blog/2025/04/01/llm-security>)

Published: 2025-04-01T00:00:00Z

Content type: opinion

Language: en

Sources: [Tim Kellogg](<https://devfeed.tech/sources/tim-kellogg.md>)

Topics: [Large Language Model](<https://devfeed.tech/topics/llm.md>), [Security](<https://devfeed.tech/topics/security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [prompt injection](<https://devfeed.tech/topics/prompt-injection.md>), [Code](<https://devfeed.tech/topics/code.md>), [integrity](<https://devfeed.tech/topics/integrity.md>)

Tags: [code](<https://devfeed.tech/tags/code.md>), [integrity](<https://devfeed.tech/tags/integrity.md>), [llms](<https://devfeed.tech/tags/llms.md>), [prompt-injection](<https://devfeed.tech/tags/prompt-injection.md>), [reviews](<https://devfeed.tech/tags/reviews.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

## AI overview

This commentary argues that large language models can help review code and identify security issues, but they are not adequate security mitigations. It recommends threat modeling focused on important assets and attack surfaces, noting that prompt injection can circumvent LLM-based reviews.

## Source excerpt

LLMs are great code reviewers. They can even spot security mistakes that open us up to vulnerabilities. But no, they're not an adequate mitigation. You can't use them to ensure security.