Finding and Fixing Vulnerabilities Using AI

4.5 Preparing the code and documentation

Like any computer system, an AI’s effectiveness depends on its input. This means that if you prepare the software (its code and documentation) to be easier for an AI to analyze, the results are likely to be much better.

Therefore, improve the code and its documentation wherever they currently lack important, relevant information. This means adding information where appropriate, such as type declarations, inline comments, documentation, and relevant specifications. This especially includes “bigger picture” information that explains why something was done. Where practical, provide links to key data or extractions of relevant data. Relevant extractions are often better [Wheeler2026].

Daniel Stenberg, leader of the curl project, reports that AI tools can reason across protocols, specs, and third-party libraries in “almost magical ways”. AI tools can identify failures to comply with a spec, as well as inconsistencies between comments and implementations [Vaughan-Nichols2026-02]. Language models’ ability to use context, e.g., comments, can be powerful [Wolff2026].

At the least, include an “AGENTS.md” file. Its format and recommendations are provided by the Linux Foundation’s Agentic AI Foundation at <https://agents.md/>. Some AI agent systems supported it when its specification was originally crafted, such as OpenAI Codex and Google Gemini. Historically, Claude Code only looked at CLAUDE.md, but as of 2026-09-18 (version 2.1.277) it now looks for and reads AGENTS.md. If you’re using an agentic system and it doesn’t support AGENTS.md, but it supports a different filename, use that filename to say “See @AGENTS.md” and use AGENTS.md so instructions that apply to an AI agent can be in one portable place.

[0xkato2024] recommends making your code well documented, suggesting the following:

• “Are your code comments up to date?
• Are there any third-party dependencies that the code relies on?
• Is there a system architecture overview?
• Have you mapped out the data flow and transaction lifecycle?
• Are access control mechanisms clearly outlined?
• Have you done a risk assessment and threat model?
• Do you have a list of all known issues with explanations?”

Finally, “if (like most) you lack some documentation, AI can help you write it, but again, review the results. If you’re using AI to create documentation [including documentation inline with the code], work bottom-up, so that the AI can maximally build on other documentation.” [Wheeler2026] This does mean that “professionals who have always written meticulous documentation are now reaping new benefits from that always valuable practice” [Dominus2026-03-05].