Know What's Happening in AI

What Researchers Learned About Building an LLM Security Workflow

Researchers from the University of Oslo and the Norwegian Defence Research Establishment demonstrated that large language models (LLMs) alone cannot reliably triage security alerts, missing every malicious case in a baseline test. When the same models were embedded in a structured workflow—using predefined SQL queries, limited grep searches, and iterative evidence gathering—the detection rate jumped to an average of 93%, with GPT‑5‑mini achieving perfect accuracy across 100 runs. The study shows that the surrounding process, tool constraints, and guardrails, not model size, drive performance. It also notes that the models tend to flag benign cases as uncertain, shifting false positives to human analysts.