Updated 2/21/2026
LLM-based autonomous agents deployed for Static Application Security Testing (SAST) false positive filtering exhibit a critical failure mode resulting in the suppression of True Positive (TP) vulnerability reports. When configured to triage alerts from tools such as CodeQL, Semgrep, and SonarQube, agents including SWE-agent, OpenHands, and Aider incorrectly classify legitimate, exploitable vulnerabilities as false positives. This vulnerability suppression is highly correlated with specific…
Sifting the Noise: A Comparative Study of LLM Agents in Vulnerability False Positive Filtering
Affects: Claude Sonnet 4, DeepSeek Chat, GPT-5
Source: arXiv