Tag
A large-scale empirical study analyzing 3.52 million C++ code changes in production to compare AI-generated versus human-written code quality, finding higher coupling and compute overhead but showing targeted feedback can mitigate issues.
The author built LintLang, a deterministic linter for agent configs that catches structural language defects like vague tool descriptions and conflicting instructions before runtime, and notes that Character.AI's Larch framework adopted it in CI. The post asks developers which runtime failures should be caught statically.
SafeAI is an Apache-2.0 static analyzer for AI-agent applications that scans source and configuration for capabilities, risks, tools, MCP integrations, secrets, and governance signals, producing a versioned KYA manifest and CI gating. The author is seeking contributors and reviewers.
A static analysis scanner tested five DTC brands and found that despite good structured data, their custom JavaScript (e.g., size pickers using <div> instead of <select>) makes them inaccessible to AI shopping agents, potentially costing $82K–$491K monthly in lost revenue from AI-referred traffic.
A developer built a Go-based AI agent that uses read-only tools to triage false positives from SAST scanners, testing it against OWASP BenchmarkJava with Claude Sonnet, DeepSeek-V4-Pro, and Kimi k3, achieving strong results especially with Kimi k3.
Describes the development of an open-source static analyzer that leverages multiple coding models to evaluate the capabilities and risks of AI agents.
The Go analysis framework provides a modular interface for static analysis of Go code, enabling reusable checkers across various tools like vet, IDEs, and build systems.
pkgxray is a zero-dependency static analysis tool that inspects npm packages and MCP servers before installation, providing SAFE/REVIEW/BLOCK verdicts to prevent supply-chain attacks.
CodeSizer is a static code size profiling tool for embedded firmware that uses objdump and addr2line to attribute code size to inline call trees and generates an HTML report.
The Harness Handbook is a behavior-centric representation synthesized from agent harness codebases using static program analysis and LLM assistance, helping developers and coding agents locate code implementing specific behaviors. It introduces Behavior-Guided Progressive Disclosure (BGPD) to guide agents from high-level descriptions to relevant implementation details, improving localization accuracy and edit-plan quality.
This paper formalizes the 'patchwork problem' where LLM-generated code is locally correct but structurally incoherent across a codebase, proposes a taxonomy of eight failure categories and a hybrid verification framework, and demonstrates that many failures evade current tools.
This paper introduces InterFLOPBench, a benchmark for evaluating LLMs on detecting floating-point errors in C code, finding that recent models achieve high F1-scores, though performance varies by error type.
The author introduces FCM Trust, a local scanner for reviewing AI agent projects' security, permissions, and reliability, and asks the community about their own review methods for agent tool access.
OxCaml, Jane Street's superset of OCaml, introduces a `[@zero_alloc]` annotation that forces the compiler to refuse to build if any function in the call tree allocates on the heap, shifting allocation detection from runtime profiling to compile-time enforcement.
This article delves into the differences between C in the Linux kernel and ordinary userspace C, covering core techniques such as resource management, error handling, concurrency, logging, static analysis, and extensively using GNU C extensions and kernel-specific patterns.
This paper investigates how lightweight static analysis annotations can serve as deterministic anchors to improve the predictability and reproducibility of LLM-based code agents navigating software repositories, finding that such anchoring improves localization and reduces variance.
cargo-geiger is a Rust cargo plugin that lists statistics about unsafe code usage in a crate and its dependencies, providing input for auditing.
The author built a code context graph parser that creates a graph from static analysis and exposes it via MCP for AI agents. In a head-to-head comparison with Gemma 4 26B, agents using the graph explored Apache Kafka's request flow in under 2 minutes, while the baseline agent without the graph ran out of rate limits in 6 minutes.
brooks-lint is an AI code review tool based on twelve classic software engineering books, providing structured, traceable code regression risk assessment and repair suggestions, aiming to avoid quality issues in AI-generated code.
Anthropic released an open-source code auditing reference harness for autonomous vulnerability discovery and remediation using Claude, covering a recon→find→triage→report→patch pipeline, primarily targeting C/C++ memory vulnerabilities. It is a template/reference implementation rather than a production-ready product, with a managed hosted option called Claude Security also available.