Newest papers

AgenticVulHunter: Bringing Local Agentic Vulnerability Hunting to Your Terminal

Nishant Abhishek, Ping Charoenwet, Kla Tantithamthavorn · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.27383 · cited by 0 works (OpenAlex) · open-access PDF

Japanese

Agenの脆弱性の早期発見は、それらが生産システムに影響を与える前に、ソフトウェア攻撃のリスクを減らすために重要である。しかし、セキュアコードレビュー中に脆弱性の検出は、脆弱なコードの論理が異なるレポジトリファイルで見つかるラインに依存する可能性があるため、依然として困難である。最近のアプローチ、例えばAgenticSCRは、LLMエージェントは、セキュアコードレビューを改善するためのセキュアコードのリスクを削減し、セキュリティの知識を使用することができることを示しています。しかし、これらのアプローチは主に外部の商用LLMに依存し、エージェントに同時に大量のセキュアコードレビューアプローチとツール

Machine translation (Meta M2M100); the English original follows.

Abstract

Finding vulnerabilities early, before they can affect the production system, is important for reducing the risk of any software attacks. However, detecting vulnerabilities during secure code review is still difficult because the vulnerable code logic may depend on lines found across different repository files. Recent approaches such as AgenticSCR have shown that LLM agents can explore repository files and use security knowledge to improve secure code review. However, these approaches mainly rely on external commercial LLMs and can provide a large amount of security knowledge to the agent at once. This creates an important question of whether agentic secure code review can also be performed effectively using locally deployed open-weight LLMs with more focused and relevant security knowledge. In this paper, we propose AgenticVulHunter, an agentic secure code review approach and tool that can run with a locally deployed open-weight LLM. We evaluate AgenticVulHunter on 144 vulnerability cases from SCRBench using Qwen3-Coder-30B and DeepSeek V3.1 Terminus. We measure what percentage of generated review comments correctly identify the vulnerable location, match the vulnerability type, and provide a relevant security review comment together. AgenticVulHunter achieves an accuracy of 18.4% with Qwen3- Coder-30B and 23.8% with DeepSeek V3.1 Terminus, compared with 11.8% for our AgenticSCR-style reproduction using Qwen3-Coder-30B and 17.5% for AgenticSCR using Claude Sonnet 4.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Vulnerability (computing), Computer security, Computer science, Code (set theory), Internet privacy, Security through obscurity

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange