CAN LLMS DETECT IDORS? UNDERSTANDING THE BOUNDARIES OF AI REASONING

Summary from the TLDR InfoSec newsletter

Semgrep tested Claude Code with Sonnet 4 and OpenAI Codex with GPT5's ability to detect IDOR vulnerabilities in code with four levels of increasing difficulty, from no authorization to implicit authorization through middleware. In total, the models identified 15 real, previously unknown vulnerabilities and 93 false positives, with Sonnet 4 performing best. In its test with a generic prompt, Semgrep found that the models could detect some simpler IDOR vulnerabilities but failed in more complex cases.