SOURCE-LINKED INTELLIGENCE

Vulnerability Localization Benchmark: Measuring Agentic Security Analysis at Repository Scale

arXiv · AI, language, vision and robotics · article · Sep 14, 2026 · UTC

Language-model agents increasingly operate over complete software repositories, yet cybersecurity evaluations primarily measure whether they can detect, reproduce, or repair vulnerabilities rather than whether they can locate the relevant code. We study vulnerability localization: given a weakness class and an unfamiliar repository, identify the implementation files associated with that weakness. We introduce the Vulnerability Localization Benchmark (VLoc Bench), comprising 500 real world vulnerabilities from 290 repositories across six package ecosystems and 147 CWE categories. Each task pair

Read original source ↗ Open in workspace

recordType: paper
region: Global

Evidence & attribution

arXiv · AI, language, vision and robotics · 2026-09-14T17:44:51.000Z

First collected: 2026-09-20T09:41:04.278Z. This is not the publication date.