I’m anti LLM for a lot of applications, for a lot of reasons, but there are obviously things that it is useful for, and I think this is one of them. If a cybersecurity specialist reviews the flaws flagged by the LLM, confirms they are legitimate, and uses that data to fix them, I don’t see an issue.