# AgenticSCR: An Autonomous Agentic Secure Code Review for Immature Vulnerabilities Detection

arXiv: https://arxiv.org/abs/2601.19138 · HTML: https://mlsanity.com/paper/2601.19138/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use.
- Builds on 25 of its 55 references that are in the map.
- First posted on arXiv 27 Jan 2026.

## Placed in

- LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/)

## Builds on (most cited first, 25 of 25)

- [CodeBERT: A Pre-Trained Model for Programming and Natural Languages](https://mlsanity.com/paper/2002.08155/) (2020)
- [Heterogeneous Graph Transformer](https://mlsanity.com/paper/2003.01332/) (2020)
- [AI Agents vs. Agentic AI: A Conceptual Taxonomy, Applications and Challenges](https://mlsanity.com/paper/2505.10468/) (2025)
- [Towards Automating Code Review Activities](https://mlsanity.com/paper/2101.02518/) (2021)
- [ChatGPT for Vulnerability Detection, Classification, and Repair: How Far Are We?](https://mlsanity.com/paper/2310.09810/) (2023)
- [CodeAgent: Autonomous Communicative Agents for Code Review](https://mlsanity.com/paper/2402.02172/) (2024)
- [BitsAI-CR: Automated Code Review via LLM in Practice](https://mlsanity.com/paper/2501.15134/) (2025)
- [An Empirical Study of Static Analysis Tools for Secure Code Review](https://mlsanity.com/paper/2407.12241/) (2024)
- [JITLine: A Simpler, Better, Faster, Finer-grained Just-In-Time Defect Prediction](https://mlsanity.com/paper/2103.07068/) (2021)
- [Similarity-based Android Malware Detection Using Hamming Distance of Static Binary Features](https://mlsanity.com/paper/1908.05759/) (2019)
- [Code-centric Learning-based Just-In-Time Vulnerability Detection](https://mlsanity.com/paper/2304.08396/) (2023)
- [LAURA: Enhancing Code Review Generation with Context-Enriched Retrieval-Augmented LLM](https://mlsanity.com/paper/2512.01356/) (2025)
- [Prompting and Fine-tuning Large Language Models for Automated Code Review Comment Generation](https://mlsanity.com/paper/2411.10129/) (2024)
- [Evaluating Large Language Models for Code Review](https://mlsanity.com/paper/2505.20206/) (2025)
- [Less is More: Supporting Developers in Vulnerability Detection during Code Review](https://mlsanity.com/paper/2202.04586/) (2022)
- [RovoDev Code Reviewer: A Large-Scale Online Evaluation of LLM-based Code Review Automation at Atlassian](https://mlsanity.com/paper/2601.01129/) (2026)
- [Why Security Defects Go Unnoticed during Code Reviews? A Case-Control Study of the Chromium OS Project](https://mlsanity.com/paper/2102.06909/) (2021)
- [Toward Effective Secure Code Reviews: An Empirical Study of Security-Related Coding Weaknesses](https://mlsanity.com/paper/2311.16396/) (2023)
- [CodeFuse-CR-Bench: A Comprehensiveness-aware Benchmark for End-to-End Code Review Evaluation in Python Projects](https://mlsanity.com/paper/2509.14856/) (2025)
- [iCodeReviewer: Improving Secure Code Review with Mixture of Prompts](https://mlsanity.com/paper/2510.12186/) (2025)
- [SecureReviewer: Enhancing Large Language Models for Secure Code Review through Secure-aware Fine-tuning](https://mlsanity.com/paper/2510.26457/) (2025)
- [Code Review Comprehension: Reviewing Strategies Seen Through Code Comprehension Theories](https://mlsanity.com/paper/2503.21455/) (2025)
- [Hierarchical Tree-structured Knowledge Graph For Academic Insight Survey](https://mlsanity.com/paper/2402.04854/) (2024)
- [Toward Realistic Evaluations of Just-In-Time Vulnerability Prediction](https://mlsanity.com/paper/2507.10729/) (2025)
- [Why Don't Developers Detect Improper Input Validation?'; DROP TABLE Papers; --](https://mlsanity.com/paper/2102.06251/) (2021)

## Built on by (most cited first, 2 of 2)

- [DREA: Decoupled Reasoning and Exploration Agents for Repository-Level Vulnerability Detection](https://mlsanity.com/paper/2607.13439/) (2026)
- [Antares: Foundation Models for Agentic Vulnerability Localization](https://mlsanity.com/paper/2608.02407/) (2026)

## Abstract (arXiv)

Secure code review is critical during pre-integration, where Atlassian developers rely on lightweight analysis tools, while deep security assessment is deferred to later stages, delaying feedback and increasing remediation costs. Existing static analyzers are often noisy and struggle with context-dependent or partially manifested vulnerabilities, while static large language model (LLM) reviewers are constrained by context windows and lack tool interaction. Agentic AI, which combines LLMs with code navigation, shows promise; however, its effectiveness for early-stage secure code review remains underexplored. We present AgenticSCR, an agentic secure code reviewer augmented with security-focused semantic memory that grounds reasoning in structured security knowledge to detect vulnerabilities before they fully manifest. AgenticSCR achieves at least 153% relative improvement in generating comments with correct localization, vulnerability type, and relevance over static LLM baseline, multi-agent reviewer, and SAST tools. In a shadow deployment, 54% of its comments were validated by security engineers for developer reporting, demonstrating practical utility while underscoring the difficulty of the task. These findings position the security-focused semantic memory as a promising direction for agentic secure code review, enabling early-stage vulnerability identification. Our approach builds an important step toward reliable localization, detection, and explanation in shift-left security practices