When LLMs generate infrastructure security fixes, providing live cluster topology (service call graphs and account bindings) is critical—it prevents patches that comply with security rules but break dependent services, raising correctness from 11% to 78% for topology-sensitive issues.
This paper shows that giving LLMs information about a Kubernetes cluster's live service dependencies significantly improves their ability to generate correct security patches. The authors built KuTIE, a system that feeds LLMs real-time cluster topology data alongside security findings, and tested it on a healthcare cluster.