Evidence · DiggingBeagle record
arXiv 2610.38617: deterministic SAST versus AI review in VulnBench 2.0
Paired study of 108 attacker-reachable web vulnerabilities, model/harness policy effects, source-to-sink scoring and cost.
- Source role
- primary disclosure
Evidence record
Paired study of 108 attacker-reachable web vulnerabilities, model/harness policy effects, source-to-sink scoring and cost.
Claim-level citations (1)
- supportsVulnBench found AI review and deterministic SAST complementary, with harness-specific blind spots: In the 108-flaw VulnBench 2.0 study, Snyk Code matched 89 issues, Claude Code Opus 5 at high effort matched 85, and their union matched 101, while harness reporting policies excluded some real vulnerability classes.
arXiv 2610.38617, Abstract, Main recall results, Harness policy and Threats to validity