Two studies target the cost of static analysis: a CodeQL false-positive taxonomy and LLM-generated queries

Two independent arXiv cs.CR papers (2026-09-03 and 2026-09-09) report ways to make CodeQL-based vulnerability detection more tractable: query refinements guided by a false-positive taxonomy removed 81.8% of reviewed false positives across 167 Java CVE…

The two reports describe separate, complementary studies rather than a single event, and they do not disagree with each other. The first (2026-09-03) ran CodeQL's Java security query suite on 167 CVE instances from 110 projects, manually reviewing 500 sampled false-positive paths and building a five-category taxonomy led by Missed Path Constraint or Sanitization (36.6%), Benign Execution Context (29.4%), and Missing Trust Boundary Modeling (27.6%). Guided by that taxonomy, query-level refinements removed 81.8% of reviewed false positives and 15.8% of reported paths across the selected queries while retaining 7 of 8 true positives; agentic coding tools given the refinement patterns as templates adapted them to new projects successfully in 56% and 62% of tasks, versus 28% without guidance, and the paper proposes a refinement-oriented SAST workflow to reduce repeated triage. The second (2026-09-09) evaluated whether LLMs can synthesize executable CodeQL queries from National Vulnerability Database (NVD) vulnerability data across multiple LLM architectures, reporting an 82% improvement in average F1-score over baseline CodeQL suites on real-world vulnerabilities. Its cost-benefit analysis finds that direct LLM-based scanning of entire repositories is often computationally and financially prohibitive, positioning LLM query synthesis as a scalable, cost-effective alternative and a path from unstructured vulnerability reports to formal static-analysis specifications.

• Study 1 (2026-09-03): CodeQL's Java security query suite was run on 167 CVE instances from 110 projects.
• Study 1: 500 sampled false-positive paths were manually reviewed and categorized into a five-category taxonomy.
• Study 1: top false-positive causes were Missed Path Constraint or Sanitization (36.6%), Benign Execution Context (29.4%), and Missing Trust Boundary Modeling (27.6%).
• Study 1: query-level refinements removed 81.8% of reviewed false positives and 15.8% of reported paths across the selected queries while retaining 7 of 8 true positives.
• Study 1: agentic coding tools given refinement patterns as templates adapted them to new projects in 56% and 62% of tasks, versus 28% unaided.
• Study 2 (2026-09-09): LLM-generated CodeQL queries built from NVD data improved average F1-score by 82% over baseline query suites.
• Study 2: multiple LLM architectures were evaluated against real-world vulnerabilities for coverage and precision.
• Study 2: direct LLM scanning of entire repositories is often computationally and financially prohibitive; LLM query synthesis is presented as a scalable, cost-effective alternative.