Newest papers

AgenticVulHunter: Bringing Local Agentic Vulnerability Hunting to Your Terminal

Nishant Abhishek, Ping Charoenwet, Kla Tantithamthavorn · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.27383 · cited by 0 works (OpenAlex) · open-access PDF

Korean

Agen의 취약점을 일찍 찾는 것은 생산 시스템에 영향을 미칠 수 있기 전에 소프트웨어 공격의 위험을 줄이기 위해 중요합니다. 그러나 보안 코드 검토 중 취약점을 감지하는 것은 취약한 코드 논리가 여러 레포지토리 파일에서 발견되는 라인에 의존할 수 있기 때문에 여전히 어렵습니다. AgenticSCR와 같은 최근의 접근 방식은 LLM 에이전트가 보안 코드 검토를 개선하기 위해 보안 파일을 탐색하고 보안 지식을 사용할 수 있음을 보여주었습니다. 그러나 이러한 접근법은 주로 외부 상업용 LLM에 의존하며 한 번에 에이전트에게 보안 지식을 많이 제공 할 수 있습니다. 이것은 지역적으로 배포된 오픈 무게 LLM와 함께 실행될 수 있는 중요한 질문을 만듭니다

Machine translation (Meta M2M100); the English original follows.

Abstract

Finding vulnerabilities early, before they can affect the production system, is important for reducing the risk of any software attacks. However, detecting vulnerabilities during secure code review is still difficult because the vulnerable code logic may depend on lines found across different repository files. Recent approaches such as AgenticSCR have shown that LLM agents can explore repository files and use security knowledge to improve secure code review. However, these approaches mainly rely on external commercial LLMs and can provide a large amount of security knowledge to the agent at once. This creates an important question of whether agentic secure code review can also be performed effectively using locally deployed open-weight LLMs with more focused and relevant security knowledge. In this paper, we propose AgenticVulHunter, an agentic secure code review approach and tool that can run with a locally deployed open-weight LLM. We evaluate AgenticVulHunter on 144 vulnerability cases from SCRBench using Qwen3-Coder-30B and DeepSeek V3.1 Terminus. We measure what percentage of generated review comments correctly identify the vulnerable location, match the vulnerability type, and provide a relevant security review comment together. AgenticVulHunter achieves an accuracy of 18.4% with Qwen3- Coder-30B and 23.8% with DeepSeek V3.1 Terminus, compared with 11.8% for our AgenticSCR-style reproduction using Qwen3-Coder-30B and 17.5% for AgenticSCR using Claude Sonnet 4.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Vulnerability (computing), Computer security, Computer science, Code (set theory), Internet privacy, Security through obscurity

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange