LLM vulnerability auditors defer more to false assurances than false alarms
Across 16,572 audits of PrimeVul pairs, true static-analysis notes barely helped, while fabricated assurances cut real-bug detection by up to 19 points.
Stories per day · 30 days
Relatedstatic-analysis2automated-repair1code-clone-detection1false-evidence1false-positives1fault-localization1github1llm-auditing1multi-agent1ossscope1primevul1sast1sca1supply-chain1vulnloc1
7 stories, newest first · one card per story
Stories tagged #c-cpp
DeepAVR multi-agent system repairs 92.3% of VulnLoc flaws
Specialized agents re-localize from failed patches and reject symptom-only fixes on real C/C++ bugs.
OSSScope builds a code-clone feature set from 190K C repos
The selected set holds 61 million fingerprinting functions and is reported to improve recall 22.65% over prior tools.
VulnSAGE checks LLM judgments of SAST reports against program structure
On 187 labeled reports it rejected 89 of 97 false alarms and kept 85 of 90 real defects.
AI-powered fuzzing with the GitHub Security Lab Taskflow Agent
GitHub Security Lab's Taskflow Agent autonomously fuzzes C/C++ repositories with AFL++ and writes vulnerability reports.
TraceVIC: Causal Reasoning over Code Evolution for Identifying Vulnerability-Inducing Commits
TraceVIC ranks vulnerability-inducing commits by reasoning over how vulnerable code evolves across revisions.
Can your coding style predict whether your code is vulnerable?
University of Massachusetts Dartmouth researchers present VulStyle, a stylometry-based vulnerability detector that also exposes benchmark reliability problems.
2