Vulnerability Localization Benchmark: Measuring Agentic Security Analysis at Repository Scale
VLoc Bench tests 27 language models at locating vulnerable files in 290 repositories; best system reaches 0.229 File F1 and 38.4% of tasks unsolved.
The Vulnerability Localization Benchmark (VLoc Bench) contains 500 real-world vulnerabilities from 290 repositories across six package ecosystems and 147 CWE categories, pairing pre-fix and post-fix repository snapshots. Agents receive only a CWE description and read-only terminal access to identify affected files, and must confirm absence on patched snapshots. The strongest of 27 language models and four static-analysis tools achieves just 0.229 File F1; 38.4% of tasks receive no correct localization, and effective localizers still report unsupported locations on patched repositories.
50