mlsanityData to 7 Oct 2026

From Trace to Line: LLM Agent for Real-World OSS Vulnerability Localization

arXiv 2510.02389 ↗First posted 30 Sep 2025cs.SE cs.CR cs.LGcited by 4

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Large language models show promise for vulnerability discovery, yet prevailing methods inspect code in isolation, struggle with long contexts, and focus on coarse function- or file-level detections that offer limited guidance to engineers who need precise line-level localization for targeted patches. We introduce T2L, an executable framework for project-level, line-level vulnerability localization that progressively narrows scope from repository modules to exact vulnerable lines via AST-based chunking and evidence-guided refinement. We provide a baseline agent with an Agentic Trace Analyzer (ATA) that fuses runtime evidence such as crash points and stack traces to translate failure symptoms into actionable diagnoses. To enable rigorous evaluation, we introduce T2L-ARVO, an expert-verified 50-case benchmark spanning five crash families in real-world projects. On T2L-ARVO, our baseline achieves up to 58.0% detection and 54.8% line-level localization rate. Together, T2L framework advance LLM-based vulnerability detection toward deployable, precision diagnostics in open-source software workflows.

Key facts. Cited by 4 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 34 of its 60 references that are in the map. First posted on arXiv 30 Sep 2025.

Builds on

34 of 60 references.

Closest ancestors · 5

Same direction, newest first

  1. 2025CRAKEN: Cybersecurity LLM Agent with Knowledge-Based Execution21 May
  2. 2025D-CIPHER: Dynamic Collaborative Intelligent Multi-Agent System with Planner and Heterogeneous Executors for Offensive Security15 Feb
  3. 2024PentestAgent: Incorporating LLM Agents to Automated Penetration Testing7 Nov
  4. 2024EnIGMA: Interactive Tools Substantially Assist LM Agents in Finding Security Vulnerabilities24 Sep
  5. 2024AutoSafeCoder: A Multi-Agent Framework for Securing LLM Code Generation through Static Analysis and Fuzz Testing16 Sep

Other references · 29

  1. 2024SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineeringcited by 1,628
  2. 2024A Survey on the Memory Mechanism of Large Language Model based Agentscited by 622
  3. 2024From Generation to Judgment: Opportunities and Challenges of LLM-as-a-judgecited by 480
  4. 2019Devign: Effective Vulnerability Identification by Learning Comprehensive Program Semantics via Graph Neural Networkscited by 266
  5. 2023InterCode: Standardizing and Benchmarking Interactive Coding with Execution Feedbackcited by 229
  6. 2024Cybench: A Framework for Evaluating Cybersecurity Capabilities and Risks of Language Modelscited by 156
  7. 2024NYU CTF Bench: A Scalable Open-Source Benchmark Dataset for Evaluating LLMs in Offensive Securitycited by 90
  8. 2024When LLMs Meet Cybersecurity: A Systematic Literature Reviewcited by 70
  9. 2023Large Language Models for Test-Free Fault Localizationcited by 67
  10. 2024ProtAgents: Protein discovery via large language model multi-agent collaborations combining physics and machine learningcited by 63
  11. 2023A Quantitative and Qualitative Evaluation of LLM-Based Explainable Fault Localizationcited by 50
  12. 2023Data Quality for Software Vulnerability Datasetscited by 49
17 more
  1. 2024AgentFL: Scaling LLM-based Fault Localization to Project-Level Contextcited by 47
  2. 2024An Empirical Evaluation of LLMs for Solving Offensive Security Challengescited by 33
  3. 2024Survey of different Large Language Model Architectures: Trends, Benchmarks, and Challengescited by 31
  4. 2024LLMs and the Future of Chip Design: Unveiling Security Risks and Building Trustcited by 18
  5. 2025ChemGraph: An Agentic Framework for Computational Chemistry Workflowscited by 16
  6. 2024ProLLM: Protein Chain-of-Thoughts Enhanced LLM for Protein-Protein Interaction Predictioncited by 12
  7. 2024LLMs for Cyber Security: New Opportunitiescited by 11
  8. 2025From Promise to Peril: Rethinking Cybersecurity Red and Blue Teaming in the Age of LLMscited by 9
  9. 2024A Multi-Agent Approach to Fault Localization via Graph-Based Retrieval and Reflexioncited by 8
  10. 2025A PennyLane-Centric Dataset to Enhance LLM-based Quantum Code Generation using RAGcited by 7
  11. 2025Large Language Models for In-File Vulnerability Localization Can Be "Lost in the End"cited by 5
  12. 2025Benchmarking LLMs in an Embodied Environment for Blue Team Threat Huntingcited by 4
  13. 2025Improving LLM-Based Fault Localization with External Memory and Project Contextcited by 4
  14. 2025PAGENT: Learning to Patch Software Engineering Agentscited by 4
  15. 2025Where's the Bug? Attention Probing for Scalable Fault Localizationcited by 3
  16. 2025Agentic End-to-End De Novo Protein Design for Tailored Dynamics Using a Language Diffusion Modelcited by 2
  17. 2025Towards Explorative IRBL: Combining Semantic Retrieval with LLM-driven Iterative Code Explorationcited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 4.

4 papers.

  1. 2026CTFExplorer: Evaluating LLM Offensive Agents Through Multi-Target Web CTF Benchmarkingcited by 3
  2. 2026Antares: Foundation Models for Agentic Vulnerability Localizationcited by 2
  3. 2026AI In Cybersecurity Education -- Scalable Agentic CTF Design Principles and Educational Outcomescited by 1
  4. 2026RAVEN: Retrieval-Augmented Vulnerability Exploration Network for Memory Corruption Analysis in User Code and Binary Programscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026FuzzingBrain V2: A Multi-Agent LLM System for Automated Vulnerability Discovery and Reproduction
  2. 2025Benchmarking LLMs and LLM-based Agents in Practical Vulnerability Detection for Code Repositories
  3. 2025From LLMs to Agents: A Comparative Evaluation of LLMs and LLM-based Agents in Security Patch Detection
  4. 2026Vulnerability Localization Benchmark: Measuring Agentic Security Analysis at Repository Scale
  5. 2026BLAgent: Agentic RAG for File-Level Bug Localization
  6. 2026VulnGym: Benchmarking Coding Agents for Repository-Level Vulnerability Detection
  7. 2026Multi-task LLMs for Bug Classification: Efficient Inference with Auxiliary Decoding Heads
  8. 2026AutoTrace: From Patches to Triggers via Agentic Interprocedural Exploration