How Deterministic SAST and AI Security Agents Divide the Work: Coverage, Harness Policy and Cost in Snyk VulnBench 2.0

Reported by arXiv cs.CR (Liran Tal, Chris Liu, Charlotte Fereday, Sebastian Roth, Brian Clark)

Summary by Cyber Security News30 Oct 2026, 05:00 CET

About this summary. This is a short excerpt from the description that arXiv cs.CR published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://arxiv.org/abs/2610.38617

arXiv:2610.38617v1 Announce Type: new Abstract: We ask what AI coding agents and AI security harnesses find that deterministic static application security testing (SAST) does not, and what they miss that SAST catches. VulnBench 2.0 is a benchmark of 108 hand-curated, attacker-reachable vulnerabilities in 20 open-source web applications in Go, JavaScript/TypeScript, Python and Java; 62 flow across more than one file.

Read the full article at arXiv cs.CR →

Source attribution: headline and facts are from arXiv cs.CR (arxiv.org). Summary method: excerpt of the source description. See our source attribution policy.