The Linux Kernel is not necessarily the most interesting target for LLMs, since it gets a huge amount of attention. I would be interested to hear what people find in less prominent projects. For completeness that includes proprietary code stored in GitHub.

In our company we found real security issues in proprietary code using Opus 4.6/4.7. Obviously typical attackers might have difficulty finding these without code access but Claude was finding real CVEs, which we fixed.

p.s., This is an argument for not trying to deal with security problems by neutering the LLMs. To the extent LLMs are effective it weakens security.

Edit: added p.s.