Research · curated 16 Sep 2026
LLM-based Vulnerability Discovery through the Lens of Code Metrics | Proceedings of the 2026 IEEE/ACM 48th International Conference on Software Engineering
First reported acm.org
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
The study warns defenders that current LLM-based vulnerability-discovery tools may add little over simple code-metric classifiers, tempering expectations for automated AI security auditing.
A research paper presented at ICSE 2026, 'LLM-based Vulnerability Discovery through the Lens of Code Metrics,' finds that a classifier trained solely on classic code metrics performs on par with state-of-the-art LLMs for vulnerability discovery. Root-cause analysis shows a causal dependency between LLM predictions and code metrics, suggesting LLMs operate at a similarly shallow level, limiting their ability to grasp complex vulnerability patterns.