# 20 - AI Vulnerability Detection Pipeline

## Overview

LLMs can find real zero-day vulnerabilities in production code. Claude Opus 4.6 found 500+ confirmed zero-days in open-source projects (Feb 2026), including a 23-year-old Linux kernel bug. Multi-agent approaches amplify this: MAVUL shows +600% detection vs single-agent, MultiVer hits 82.7% recall with just 4 parallel agents.

But a single LLM pass is unreliable: 14% true positive rate, 86% false positive rate, and non-deterministic (3 identical runs yield 3, 6, and 11 findings). The solution is a layered pipeline combining traditional SAST tools with LLM reasoning and multi-agent validation.

This principle describes the pipeline architecture and the research backing each layer.

---

## The Pipeline

```
Layer 1: SAST Scan (Semgrep / CodeQL)
  ↓ high recall, low precision (35.7%)
Layer 2: LLM False-Positive Filter
  ↓ contextual reasoning reduces FP by ~91%
Layer 3: Multi-Agent Diverse Review
  ↓ 3-5 agents with different security perspectives
Layer 4: Knowledge-Enriched RAG
  ↓ CWE/CVE knowledge base adds +16-24% accuracy
Layer 5: Adversarial Verification
  ↓ separate agent challenges each finding
Layer 6: Sandbox PoC (optional)
  ↓ automated exploit attempt in isolation
```

### Layer 1: SAST Scan

Traditional static analysis tools provide the foundation. They excel at pattern matching, taint tracking across files, and detecting known vulnerability classes deterministically.

**Tools:** Semgrep, CodeQL, SonarQube, Snyk
**Strength:** High recall, deterministic, fast
**Weakness:** High false positive rate, cannot understand business logic
**Combined baseline:** 44.7% detection rate on OWASP Benchmark

Source: [2508.04448]

### Layer 2: LLM False-Positive Filter

Feed SAST findings to an LLM with full code context. The LLM understands intent, business logic, and whether a flagged pattern is actually exploitable.

**Evidence:** SAST-Genius [2509.15433] — Semgrep + GPT-4 filter
- Precision: 35.7% (Semgrep alone) -> 89.5% (with LLM filter)
- False positives: 225 -> 20 (~91% reduction)
- Pure LLM without SAST: 65.5% — worse than hybrid

**Evidence:** IRIS (neurosymbolic) — LLM generates CodeQL source/sink specs
- CodeQL alone: 27 vulnerabilities found
- With LLM: 55 vulnerabilities found (+104%)
- False discovery rate improved 5%

**Key insight:** LLM + SAST > either alone. They have complementary blind spots.

### Layer 3: Multi-Agent Diverse Review

Multiple agents review the same code with different security perspectives. Diverse prompts beat identical ones by +10.8% [2502.11027].

**Perspectives (from plan-swarm-review code mode):**
1. **Attacker** — injection, auth bypass, privilege escalation
2. **Concurrency specialist** — races, deadlocks, TOCTOU, ordering
3. **Performance engineer** — unbounded allocations, event loop blocking, DoS vectors
4. **Error recovery auditor** — resource leaks, info leakage, incomplete cleanup
5. **Integration tester** — contract mismatches, type confusion, boundary issues

**Evidence:**
- MAVUL [2510.00317]: +600% vs single-agent
- MultiVer [2602.17875]: 82.7% recall with 4 agents (beats fine-tuned GPT-3.5 at 81.3%)
- VulAgent [2509.11523]: hypothesis-validation approach, +450% correct identification

**Critical: preserve minority findings.** AgentAuditor [2602.09341] shows that findings from only 1 of 5 agents are often the most valuable — non-obvious bugs that only one perspective catches. Majority voting discards them; reasoning tree audit recovers 65-82%.

### Layer 4: Knowledge-Enriched RAG

Augment agents with a vulnerability knowledge base. Not code-level RAG (raw CVE examples), but knowledge-level RAG (structured understanding of why vulnerabilities occur).

**Evidence:** Vul-RAG [ACM TOSEM 2025]
- +16-24% accuracy vs baseline LLM
- Found 10 unknown bugs in Linux kernel v6.9.6, 6 received CVE
- **Knowledge-level RAG > code-level RAG** — the key finding

**Knowledge base structure (per Vul-RAG):**
1. **Functional semantics** — what the vulnerable code does
2. **Root cause** — why the vulnerability exists (CWE mapping)
3. **Fixing patterns** — how to fix it (patch pattern templates)
4. **Trigger conditions** — when the vulnerability is exploitable
5. **Multi-dimensional index** — searchable by CWE, language, API type, pattern

### Layer 5: Adversarial Verification

A separate agent with clean context challenges each finding. "This was flagged as SQL injection — argue why it's NOT exploitable."

This mirrors Anthropic's own approach: Claude Code Security uses adversarial verification passes where Claude challenges its own findings. Reduces false positives without reducing true positives.

### Layer 6: Sandbox PoC (optional)

For high-severity findings, attempt automated exploitation in a sandbox.

**Evidence:** DeepAudit (Chinese open-source, lintsinghua) — 4 agents + sandbox verification, found 48 CVE in 16 OSS projects. AEGIS [2601.22720] — white-box exploit chain generation, reduces development from months to days.

---

## What LLMs are good and bad at

### Strong
- **Business logic vulnerabilities** — IDOR (22% TPR), state machine violations, numeric overflow
- **Contextual understanding** — whether a flagged pattern is actually exploitable given surrounding code
- **Cross-cutting concerns** — auth flow coherence, session management, trust boundary violations
- **Novel vulnerability patterns** — not in any signature database

### Weak
- **Classic injection paths** — SQL Injection (5% TPR), XSS (16% TPR) — SAST is better here
- **Cross-file taint tracking** — data flows across 10+ files/functions
- **Vulnerable vs patched code** — accuracy only 0.06-0.14 [2504.13474]
- **Availability impact** — cannot distinguish minor crash from critical outage
- **Runtime behavior** — no execution, no memory state, no timing analysis
- **Determinism** — 3 identical runs give 3, 6, 11 findings

**Rule of thumb:** Use SAST for injection/taint (Layers 1-2). Use LLM for business logic, context, and novel patterns (Layers 3-5). Use sandbox for verification (Layer 6).

---

## Practical implementation

### With Claude Code (available now)

**Built-in:**
- `/security-review` — single-pass security check
- GitHub Action `anthropics/claude-code-security-review` — automatic PR security review

**Skills:**
- `/deep-review` — parallel competency review with security checklist
- `/plan-swarm-review` (code mode) — multi-agent diverse review with 5 security perspectives
- **Trail of Bits Skills** — CodeQL + Semgrep + SARIF integration, entry point analysis (github.com/trailofbits/skills, 2400+ stars)
- **sast-skills** — 34 vulnerability classes as agent skills (github.com/utkusen/sast-skills)

**For multi-session audits (with mclaude or TeamCreate):**
- Assign each session a security perspective
- Use locks to prevent overlapping analysis
- Aggregate findings through handoffs or shared findings file
- Run adversarial verification as a separate session

### Minimal viable pipeline (immediate)

```
1. Run Semgrep (if available): semgrep --config auto .
2. Feed SAST findings to Claude: "Filter these for real issues"
3. Run /plan-swarm-review in code mode on critical files
4. Review unique catches (minority findings) carefully
```

### Full pipeline (with setup)

```
1. Install Trail of Bits Skills for Claude Code
2. Run Semgrep + CodeQL scan
3. LLM filter pass (Layer 2)
4. Launch 3-5 parallel security review agents (Layer 3)
5. Enrich with CWE knowledge base if available (Layer 4)
6. Adversarial verification on HIGH findings (Layer 5)
7. Sandbox PoC for CRITICAL findings (Layer 6)
```

---

## Chinese ecosystem (reference)

The Chinese security AI ecosystem is advanced and worth monitoring:

- **Qianxin (奇安信)** — #1 in CyberSec-Eval, "AI+Code Guardian" deployed in production (Bank of Beijing)
- **DeepAudit** (lintsinghua) — open-source, 4 agents + sandbox, 48 CVE found. Supports Ollama for private deployment
- **Fudan + Tencent A.S.E** — project-level security evaluation framework for AI-generated code
- **NSFOCUS (绿盟)** — first SecLLM white paper, AI-driven pentesting on DeepSeek
- **Tencent AI-Infra-Guard** — full-stack AI red teaming, 78 CVE in AI/ML components
- **Clouditera SecGPT** — open-source security LLM

---

## Key numbers

| Metric | Value | Source |
|---|---|---|
| Claude Opus 4.6 zero-days found | 500+ confirmed | Anthropic Feb 2026 |
| Multi-agent vs single-agent | +600% | MAVUL |
| 4 parallel agents recall | 82.7% | MultiVer |
| SAST + LLM hybrid precision | 89.5% | SAST-Genius |
| Knowledge RAG accuracy boost | +16-24% | Vul-RAG |
| Linux kernel CVE via RAG | 6 confirmed | Vul-RAG |
| Minority finding recovery | 65-82% | AgentAuditor |
| Single LLM SQL injection TPR | 5% | Semgrep blog |
| Single LLM non-determinism | 3-11x variance | Semgrep blog |

---

## Sources

- [2502.11027] Sampling diversity in LLM inference (Feb 2025)
- [2602.09341] AgentAuditor: reasoning tree > majority voting (Feb 2026)
- [2602.17875] MultiVer: zero-shot multi-agent vulnerability detection (Feb 2026)
- [2510.00317] MAVUL: multi-agent contextual reasoning (Oct 2025)
- [2509.11523] VulAgent: hypothesis-validation (Sep 2025)
- [2509.15433] SAST-Genius: Semgrep + GPT-4 hybrid (Sep 2025)
- [2504.13474] LLM vulnerability detection limitations (Apr 2025)
- [2601.22720] AEGIS: white-box attack path generation (Jan 2026)
- [2508.04448] LLM vs SAST benchmarking (Aug 2025)
- Vul-RAG, ACM TOSEM 2025 — knowledge-level RAG for vulnerability detection
- Anthropic blog: Claude Code Security (Feb 2026)
- Anthropic blog: Project Glasswing / Mythos Preview (Apr 2026)
- Semgrep blog: Finding vulnerabilities with Claude Code (2025)
- Trail of Bits Skills: github.com/trailofbits/skills
- DeepAudit: github.com/lintsinghua/DeepAudit
