huhusmang/Awesome-LLMs-for-Vulnerability-Detection

What it is

huhusmang/Awesome-LLMs-for-Vulnerability-Detection is a curated GitHub list in four parts: papers from 2025 onward (2024 and earlier sit in a separate Papers Archive), open-source projects, vendor agent skills, and an arxiv.md file. A GitHub workflow updates arxiv.md daily with new Arxiv papers matching set keywords. The workflow is adapted from LLM4SE and rewritten to use the arxiv library.

What the list holds beyond the summary

Projects the summary does not name:

• deepsec (Vercel): a security harness for deep codebase scanning with coding agents.
• rust-in-peace: agent-assisted vulnerability discovery for Rust, with adversarial triage, dynamic verification and an experimental Android APK analysis profile.

Entries the summary names, with the detail that sets them apart:

• Darkmoon is GPL-3.0 and also an MCP host. It has per-technology offensive sub-agents, Active Directory and Kubernetes coverage, 80+ orchestrated tools, and an evidence trail per finding.
• DeepAudit validates exploits in a Docker sandbox.
• OpenAnt (Knostic) uses adversarial verification.
• strix installs via pip.
• Cloudflare's security-audit-skill runs six phases with parallel hunting agents and adversarial validation.
• Anthropic's defending-code-reference-harness covers threat modeling, scanning, triage and patching with Claude Code.
• OpenAI's codex-security does repo-level scanning via Codex agents.

Benchmarks are not interchangeable:

• SecVulEval targets real-world C/C++ detection.
• VulnGym targets repository-level detection by coding agents (2026).
• CVE-Bench (NAACL 2025) is titled as measuring repair of real-world CVEs, not detection.
• SV-TrustEval-C (SP 2025) tests structure and semantic reasoning.
• Mono (2025) examines whether "clean" vulnerability datasets contain undecidable patches.

Empirical papers relevant to deployment:

• "Sifting the Noise" (ISSTA 2026) compares LLM agents at filtering false positives.
• "LLM-based Vulnerability Detection at Project Scale: An Empirical Study" (2026).
• "Closing the Gap" (ICSE 2025) is a user study of AI vulnerability detection and repair in the IDE.
• "Vulnerability Detection with Code Language Models: How Far Are We?" (ICSE 2025).

Caveats

The page is an index of titles, venues and links. It gives no benchmark numbers, no comparison of the tools, and no setup instructions. Which tools work, and how well, has to be checked in each linked repository or paper. Many 2026 papers are listed without a venue.