TL;DR for operators An autonomous security agent can notice far more suspicious code paths than it can fully prove vulnerable during a fixed audit window. In the paper’s 300-trajectory analysis, verification consumed 73.8% of wall-clock time, compared with 7.3% for hypothesis formation; verifying one hypothesis took about 11.1 times as much time as generating one. ...
TL;DR for operators Two runs of an LLM security scanner can return almost the same number of findings while disagreeing substantially about which code locations are vulnerable. That makes finding count a weak reproducibility metric and a risky basis for remediation decisions. Bugstone-E2E, introduced in The History Is the Detector: Executing CVE Patch History, End-to-End,1 offers a broader operating model. It turns verified CVE fixing commits into reusable detection skills, uses deterministic machinery to shrink the search space before asking an LLM for semantic judgments, and sends stronger claims through separate runtime validation. ...
TL;DR for operators If an AI coding assistant can install software, do not assume it will inspect the evidence already available about where that software came from. In Pengyin Shan’s pre-registered demand-side audit,1 only 9 of 1,920 registered trials retrieved a relevant trust signal before the install-or-decline decision. Across 2,114 completed registered and supplementary trials, not one assistant executed a signature or attestation verification command. ...