An AI agent just rewrote CodeQL's official security queries and made them dramatically better at catching C and C++ bugs.
The system, called ARQ, targets a known weak spot in query-based static analyzers: the queries themselves are often wrong, missing real vulnerabilities or flagging safe code as dangerous. Researchers had ARQ generate synthetic C and C++ programs, run them, and compare the actual outcome against what a CodeQL query predicted. Any mismatch became evidence for an LLM-driven refinement loop that rewrote the query, using three commercial models - GPT-5.4, Claude-Sonnet-4.6, and Gemini-3.5-flash - without needing labeled vulnerability datasets or commit history. On the Juliet v1.3 and FormAI v2 benchmarks, the refined queries caught up to 119.8% more true positives than the originals while keeping precision at 98.0% or higher.
This matters because CodeQL's query set is maintained by humans and, per its own track record, is widely adopted across C/C++ codebases, so a stale or buggy query has wide blast radius. ARQ's refinements fixed three GitHub issues that had sat unresolved in the official CodeQL repository for as long as 27 months, and along the way surfaced two previously unknown bugs in libpng and zlib - libraries embedded in enough software that a missed flaw there matters more than most.
Self-improving static analysis is a nice idea, but the real test is whether these queries hold up on messier, real-world code beyond curated benchmarks like Juliet and FormAI, and whether maintainers trust rules an LLM rewrote enough to actually merge them.