arxiv.org/abs/2610.33509 Can Agentic Code Review Catch Vulnerabilities Before They Are Merged?
SecPRBench is a new benchmark of 265 tasks drawn from real bug-introducing commits in nine major systems, such as Firefox, V8 and OpenSSL. Across eight frontier models, recall for catching vulnerabilities ranged from 32.5% to 78.1%, and in 68% of misses the agent flagged the flawed file but blamed a different mechanism.
— via arXiv Programming Languages, Yihan Yang, Chenyuan Yang, Zijie Zhao, Anh Nguyen Hoang, Ziqi Zhang, Weidong Wang, Zhiheng Lyu, Lingming Zhang
