Tag
CodeRabbit is using OpenAI's GPT-6.1 Sol as the primary model in its security agent to strengthen code security across complex codebases, enabling cross-file risk analysis, dependency investigation, exploit verification in sandboxes, and automated fix pull requests.
研究发现安全漏洞挖掘AI代理60.4%的token用于理解代码与推理触发方式，并提出AVRI工具复用代码关系知识，在Codex和OpenCode上分别降低18.0%和23.7%成本且不损失成功率。
GitHub Security Lab used its open-source Taskflow Agent to discover 24 Android vulnerabilities, including a location leak in a navigation app with 10M downloads, and shared how to run these audit taskflows on your own repos.
Anthropic's system Mythos reportedly uncovered so many software flaws at Bank of America that the bank hired 1,000 contractors to repair them, highlighting AI's growing role in large-scale security auditing.
作者通过追踪 Linux 内核 CVE 修复数据发现，AI 批量审查代码后新漏洞数量骤降（周发布量从 600+ 降到 1），并探讨了 AI 时代软件安全、情报机构囤积漏洞以及 Windows 升级模式可能受到的冲击。
Block (Square, Cash App, Afterpay) is using OpenAI's Defense Factory and Daybreak model to automate security operations, cutting investigation times from weeks to hours and boosting triage throughput by 50%.
Epherem 是一款免费的源代码安全扫描工具，专为 AI 构建的应用设计，可检测认证、数据库访问、API 密钥泄露和依赖漏洞等问题，并支持导出报告给 Claude Code、Cursor 等 AI 编码助手。
论文指出 LLM 反编译器以可重编译性和重执行性作为主要指标时会产生误导：代码虽然能通过所有自带测试，却可能在其他合法输入上行为发散甚至使已披露漏洞悄然消失。作者提出 Decompile-Diverge 行为比较预言机，通过合成驱动程序和模糊测试语料检测行为差异，发现部分系统发散率高达 13%。
Devin 推出 Security Swarm，一个基于 Agentic MapReduce 编排多个 Devin 并行工作的安全扫描与修复产品，可构建定制威胁模型、检测并验证漏洞，并通过 Pull Request 协助修复。
PatchHolmes, accepted at AACL-IJCNLP 2026, uses an agentic listwise selection approach to pair software vulnerabilities with their fixing commits, achieving 59.95% Recall@1 versus 34.61% for pointwise baselines by having the agent inspect the full candidate list and reading ~96k tokens per query on a frozen open-weight model.
The article compares AI-powered security tools that detect real code vulnerabilities beyond basic linting, with mentions of tools like Snyk, Semgrep, and Coderabbit.
OpenAI provides Ukraine with access to its Daybreak program to enhance cyber defense for civilian infrastructure, using AI tools to identify and fix vulnerabilities.
Palo Alto Networks has launched Unit 42 Continuous Frontier AI Defense, a multi-model AI security service that uses various AI models to continuously assess vulnerabilities and speed up remediation.
GPT-6 Astra was benchmarked on a cybersecurity dataset by Aikido Security, achieving the highest recall ever recorded by rediscovering 29 out of 32 CVEs at pass@3, though the three evaluation runs cost nearly $4,000.
The author emphasizes the critical need for sophisticated AI agents to handle increasing AI security events, noting that frontier models are ahead in cybersecurity but open models are catching up quickly.
Peephole is an open-source plugin designed to help AI coding agents write secure code by detecting common vulnerabilities before they are integrated into codebases.
Cloudflare's security-audit-skill is a coding-agent tool that orchestrates parallel agents to audit codebases for vulnerabilities through a six-phase pipeline, producing structured reports.
This post shares a GitHub repository, featuring a curated set of security vulnerability samples and benchmarks, to evaluate the capabilities of static analysis tools and large models in vulnerability mining and secure code generation, covering multiple languages and the latest research findings.
This paper proposes a frequency-aware continual learning framework using large language models for smart contract vulnerability detection, addressing adaptation, forgetting, and consolidation challenges with efficient methods like FA-LoRA and APPM.
JSEF v1.10.0 is a model-agnostic LLM evaluation toolchain released with 20+ new hard vulnerability samples, designed for assessing LLMs in Java and web security contexts.