Language Model Security Database

LLM-based autonomous agents deployed for Static Application Security Testing (SAST) false positive filtering exhibit a critical failure mode resulting in the suppression of True Positive (TP) vulnerability reports. When configured to triage alerts from tools such as CodeQL, Semgrep, and SonarQube, agents including SWE-agent, OpenHands, and Aider incorrectly classify legitimate, exploitable vulnerabilities as false positives. This vulnerability suppression is highly correlated with specific…

LLM-based code agents and vulnerability detectors employing Chain-of-Thought (CoT) reasoning are susceptible to automated adversarial code obfuscation. The vulnerability exists because CoT mechanisms expose the model's decision logic, allowing reinforcement learning frameworks (such as CoTDeceptor) to iteratively refine code transformations based on the detector's own reasoning traces. By optimizing for "reasoning instability" and "hallucination" rather than just syntactic evasion, attackers…

Large Language Models (LLMs) utilized for static code analysis, code review, and autonomous software engineering exhibit a cognitive vulnerability termed "Abstraction Bias." When processing code that structurally resembles common algorithmic patterns (e.g., standard sorting algorithms, helper functions, or mathematical formulas), the model relies on high-level memorized representations of the algorithm's intent rather than analyzing the specific local logic. Adversaries can exploit this by…