I suspect that a more effective mitigation would be to have an LLM read all your HTTP requests and the actions the web server proposes to take in response and give a Jev-like approve/disapprove decision.

All good, but I suspect we're thinking about different aspects. If I understand correctly, you're pointing out that nobody is tied to legacy software any more - they can spend 37 minutes to re-implement from scratch in a safe(r) language.

My point is that everyone doing their own thing their own way means an attacker doesn't get the next thousand sites for free after finding a vulnerability in one site.

Having an LLM as sentry is a fun idea too.

Right, I agree.

I assume that was sarcastic but I think it would actually work fairly well? At least if the ends could justify paying for that many tokens.

No, I sincerely try to avoid sarcasm, and I try to remember to down vote it when I see it. It's tough to get tone across in a text forum though, so I understand the confusion.

I didn't think it was sarcastic, but it's far enough outside the Overton window that I could see why someone would.