Blog — Codelight

Security research, product updates, and notes from the Codelight team.

Topics: #ai #data-sovereignty #security #gdpr #benchmarks #supply-chain

• Context is king in code audits. We train our own models to read 524,000 tokens at once.

  Most code scanners rent a model from someone else. We train ours — extending RoPE past its native range and supervising on real call graphs — measured answering across 524,000 tokens, double the base model's native context window.

• Can you send source code to US AI services? Legally yes — and by default it leaves Europe

  The EU-US Data Privacy Framework survived its first court challenge and is under appeal. Meanwhile GitHub's EU boundary is off by default and costs 10% more, and OpenAI's own docs say prompt caching can store outside your chosen region.

• AI security in May 2026: the supply chain bit back

  Last month: a self-propagating npm/PyPI worm hit 170+ packages, prompt injection turned AI agents into RCE, and new models learned to run for 35 hours.

• Per seat. Per token. Or paid once.

  Code security is priced three ways: per developer, per token, or once for hardware. Per-seat and per-token punish you for scanning. Local doesn't.

• The $0.11 model found the same bugs as the one too dangerous to release

  Mythos found thousands of zero-days behind a restricted API. Cheap, local models find most of the same bugs. Why that's the whole bet behind Codelight.

• Pattern matching finds patterns. Attackers find weaknesses.

  Why threat-model-driven analysis catches the vulnerabilities traditional scanners miss — with far less noise.

• Your scanner reads syntax. A reviewer reads intent.

  AI code review vs. SAST: why rules that match patterns miss the bugs that get exploited — and where the scanner still earns its place.

• Why your code never leaves Europe

  Data sovereignty, GDPR, and the EU AI Act — what they mean for code security, and why we run everything on our own hardware in Europe.