[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-ai-coding-agents-still-struggle-to-build-security-checkers":10,"sections":35},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":30,"feedback":34,"feedback_at":22,"cost_usd":34,"total_tokens":34},10646,"ai-coding-agents-still-struggle-to-build-security-checkers","AI coding agents still struggle to build security checkers","A new benchmark shows AI coding agents solve fewer than half of the tasks required to build working security checkers.","AI coding agents still can't reliably build the static-analysis checkers meant to catch known security bugs, according to a new benchmark.\n\nResearchers built CheckerBench, an executable benchmark of 300 tasks drawn from 297 real-world CVEs across 167 repositories, 85 CWE categories, and five programming-language ecosystems. Each task hands an agent a vulnerable code revision, a fixed revision, a pinned analysis environment, and a starter checker scaffold, then asks it to write analyzer logic that tells the two apart. A companion framework called CheckerLab independently rebuilds every submitted checker and scores it on whether it flags the vulnerable version without flagging the fix, whether it points at the right patch location, how many false positives it generates, and how well it uses its tools. Across 21 model-and-harness combinations, each run three times, the average pass rate was 32.30%, and even the best-performing setup only reached 45.33%.\n\nStatic-analysis checkers are the unglamorous backbone of vulnerability scanning: get one wrong and you either miss real bugs or bury developers in false alarms. A sub-50% ceiling on writing them end to end, across dozens of model setups, suggests the hard part of security tooling is still well beyond autopilot.\n\nFor an industry currently pitching AI agents as drop-in replacements for application-security engineers, this is a useful gap between the pitch and the plumbing.","[\"ai agents\",\"static analysis\",\"cve benchmarks\",\"security tooling\"]","2026-10-07T04:00:00.000Z","2026-10-09T01:07:29.182Z","2026-10-09T01:07:34.894Z","published",null,[],"ai",[26,27,28,29],"ai agents","static analysis","cve benchmarks","security tooling",[31],{"name":32,"url":33},"arXiv cs.AI","https:\u002F\u002Farxiv.org\u002Fabs\u002F2610.07557",0,{"sections":36},[37,41,46,51,56,61,65,70,75,79,84,89,94,99],{"name":38,"slug":24,"count":39,"latest_published_at":40},"AI",6506,"2026-10-07T18:45:00.000Z",{"name":42,"slug":43,"count":44,"latest_published_at":45},"Security","security",911,"2026-10-07T19:53:42.000Z",{"name":47,"slug":48,"count":49,"latest_published_at":50},"Policy","policy",474,"2026-10-07T18:23:21.000Z",{"name":52,"slug":53,"count":54,"latest_published_at":55},"Deals","deals",453,"2026-10-07T23:58:31.000Z",{"name":57,"slug":58,"count":59,"latest_published_at":60},"Hardware","hardware",222,"2026-10-07T21:19:54.000Z",{"name":62,"slug":63,"count":64,"latest_published_at":18},"Science","science",187,{"name":66,"slug":67,"count":68,"latest_published_at":69},"Consumer Tech","consumer-tech",174,"2026-10-07T17:41:41.000Z",{"name":71,"slug":72,"count":73,"latest_published_at":74},"Software","software",113,"2026-10-07T18:10:00.000Z",{"name":76,"slug":77,"count":73,"latest_published_at":78},"Startups","startups","2026-10-07T23:36:57.000Z",{"name":80,"slug":81,"count":82,"latest_published_at":83},"Dev Tools","dev-tools",105,"2026-10-07T16:59:11.000Z",{"name":85,"slug":86,"count":87,"latest_published_at":88},"General","general",61,"2026-10-07T22:00:24.000Z",{"name":90,"slug":91,"count":92,"latest_published_at":93},"Gaming","gaming",56,"2026-10-07T12:00:00.000Z",{"name":95,"slug":96,"count":97,"latest_published_at":98},"Reviews","reviews",33,"2026-10-05T11:57:17.000Z",{"name":100,"slug":101,"count":102,"latest_published_at":103},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]