Nolan Lawson, a former senior engineer at Microsoft and Salesforce, has documented a new workflow: using multiple large language models to review every pull request synchronously, cross-referencing to catch real bugs instead of churning out more code. The result: code output did not increase, but quality improved markedly. He calls it "vibe coding with substance"—deliberate, methodical, quality-driven.
LLMs Excel at Finding Bugs; Verifying Them Is the New Bottleneck
Anthropic's Glasswing project (a public update to the Mythos system) provides direct evidence. The system had LLM agents scan real open-source code at scale: across over 1,000 projects, it estimated 6,202 high-severity or critical vulnerabilities and 23,019 total vulnerabilities (including low-severity). Of 1,752 bugs verified by an independent security firm, 90.6% were confirmed as real and 62.4% ranked high or critical. Anthropic's report states: "Progress in software security, once limited by the speed of finding vulnerabilities, is now limited by the speed of verification, disclosure, and remediation." AI has shifted the bottleneck from discovery to processing capacity.
Cross-Validation with Three Models on Every PR
Lawson's core tactic is to run multiple models from different vendors simultaneously, not rely on a single LLM. His toolkit includes Claude code, OpenAI's Codex, and Cursor Bugbot—all three independently review the same pull request. Results are aggregated and ranked by severity: critical, high, medium, low. The key advantage: a single model may produce false positives, but when multiple models with different training data and architectures flag the same issue, false positive rates drop dramatically while coverage rises. Lawson reports: "False positive rate is near zero, and the bug coverage is high."
The decision process is straightforward: all critical and high issues must be fixed first; medium and low are evaluated by cost-benefit; if a PR has too many critical problems, it is discarded entirely rather than patched. Lawson cites research showing that the more diverse the models, the more accurate the final report—the principle of "multi-model debiasing," where models from different training backgrounds produce different biases, and majority voting filters out individual blind spots.
Slower Coding, Higher Quality—Old Bugs Surface, Unit Tests Get Written
In practice, Lawson's code output did not increase; instead, the process often uncovered pre-existing bugs, forcing him to write unit tests. Fixing old problems took far more time than building new features. This was not his original goal, but it signals that codebase health is being systematically strengthened. He calls this approach "more deliberate vibe coding": slower, more careful, with each line of code living longer and breaking less often. Lawson emphasizes that speed is never the only metric for engineering teams—every line has a maintenance cost and a failure probability. Using AI to write code more slowly but more correctly is the sustainable path.