Where AI Vulnerability Discovery Harnesses Go Quiet: Structural False Negatives and Hidden Vulnerabilities
Companion study catalogues how code-selection, filtering, and merging steps in LLM vulnerability harnesses silently drop real vulnerabilities — a blind-spot enterprises must audit.
Summary written by editorial AI · Source link below
arXiv:2610.29379v1 Announce Type: new Abstract: LLM-based vulnerability discovery harnesses can miss real, reachable vulnerabilities because of how the harness around the model is built. Steps that select code, filter it, and store and merge findings can drop a vulnerability before or after the model runs, independently of the model's capability, and the report usually gives no sign that this happened. These drops come from engineering choices, and errors. They leave vulnerabilities undetected,
Editorial Analysis
Enterprises relying on AI-driven vulnerability scanning may harbour false confidence; structural pipeline gaps can mask reachable vulnerabilities that the model itself could find.
Audit the full pipeline of your AI-based scanning tools for silent filtering steps that could discard valid vulnerability findings.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at arXiv Crypto & Security in a new tab.
More from the Research Desk
- Signed, Sealed, and Relayed, NTLM-style: Bypassing LDAP Signing Through Reauthentication3d
- Not Where You Think: Protecting Location Privacy Against Reasoning-Based Geolocation4d
- Social-HUMINT: An LLM-Augmented Unified Framework for Measuring Social Media Exposure4d
- Practical Auditing of Differentially Private Graph Release Mechanisms: Methodology, Toolkit, and Case Study4d
- SecLog-Bench: A Scalable Benchmark for Cybersecurity Log Reasoning with Scaffolded Evidence4d