In security review, large language models are useful, but they also create a dangerous temptation: the output often sounds more certain than the evidence behind it.
A model can summarize code, suggest review directions, produce hypotheses, and write a convincing report. That is useful work. But a model sentence is not proof. In smart-contract security, cryptography, access control, asset flow, signing assumptions, and upgrade logic, an unsupported confident answer is not just noisy. It can push a reviewer toward the wrong risk, the wrong fix, or the wrong sense of completion.
I built EllipticZero Research Lab around that boundary.
Project:
https://github.com/ECD5A/EllipticZero
