38 results for “Static Analysis”

List Grid

What you seeeverything

Recent Oldest Added A–Z

All types38 Articles15 Repos10 Papers8 Threads2 Write-ups2 Talks1

“Static Analysis”

arxiv.orgpaper🧠 AI

Reva: Real-Time Vulnerability Detection through Contextual Probing of Large Language Models

REVA (REal-time Vulnerability Analysis) is a vulnerability detector that puts a module threat model, lightweight static analysis findings and call-graph information into one LLM forward pass. A trained probe reads the model's internal representations of the new function. On PrimeVul's held-out test set, REVA on GLM-5.3-Flash reaches 60.0% accuracy in about one second per function, matching the agentic VulTriage (59.2%) at over 250 times the speed and under a tenth of the cost. The probe is 14% to 17% more accurate than the LLM's own verdict.

LLMstatic analysis

REVAVulTriagePrimeVul+2

research, coding-agents· Added 28 Oct 2026, published 26 Oct 2026

arxiv.orgpaper🛡️ Security

Reva: Real-Time Vulnerability Detection through Contextual Probing of Large Language Models

REVA (REal-time Vulnerability Analysis) is an LLM-based vulnerability detector that screens each new function in one forward pass. It feeds the model a pre-computed module threat model, lightweight static analysis findings and call-graph data, then reads the model's internal representations with a trained probe. On PrimeVul's held-out test set with GLM-5.3-Flash it reaches 60.0% accuracy in about one second per function, matching the agentic VulTriage (59.2%) while over 250 times faster.

LLMGLM

REVAVulTriagePrimeVul

AI Security, AppSec· Added 28 Oct 2026, published 26 Oct 2026

wiz.ioarticle🛡️ Security

Supply Chain Zero Days: Closing the Gap Between Publication and Detection

Wiz describes its pipeline that analyzes every new npm package version at publication, combining static analysis, an AI classifier, sandbox dynamic analysis and runtime sensor observation, then pushes IOCs to Wiz Defend before a CVE exists. It cites supply chain attacks rising from about 10% of significant incidents in H2 2025 to 25% in H1 2026, and the Axios compromise (v1.14.1, v0.30.4). The keyv case shows C2 domains fetched from an Ethereum smart contract, which only runtime monitoring caught.

npmWizEthereum

Axioskeyvcacheable+3

Supply Chain, Blue Team & Detection· Published and added 19 Oct 2026

endorlabs.comarticle🛡️ Security

What Is SAST? Static Analysis in the Age of AI-Generated Code | Endor Labs

Explainer on Static Application Security Testing. It covers how SAST builds an AST and runs taint analysis from sources to sinks, which flaw classes it catches (SQLi, XSS, hardcoded secrets, weak crypto) and which it misses (IDOR and other access-control bugs). It compares SAST with DAST and SCA, cites false-positive and false-negative figures (91% false positives in a 2025 study of about 3,000 repositories; 47–80% of vulnerabilities missed), and argues for reachability analysis and reasoning-based AI SAST. It ends with evaluation criteria and a rollout plan; the vendor's own benchmark claims are preliminary.

Endor Labs

OWASPOWASP Top 10IDOR+4

AppSec, Learning· Published and added 12 Oct 2026

endorlabs.comarticle🛡️ Security

Static SCA vs. Dynamic SCA: Which is Better (and Why It's Neither) | Blog | Endor Labs

Compares static SCA (manifest/source scanning at build time) with dynamic SCA (runtime instrumentation). Static scans are complete but noisy and miss dependencies absent from manifests, for example in Python. Dynamic scans are relevant but incomplete, add agent overhead and surface findings late. It argues eBPF improves deployability of dynamic SCA but not its coverage limit. A worked example with a library of N vulnerable functions illustrates the difference. The author, Endor Labs, advocates static analysis of source code plus reachability analysis to filter findings by whether vulnerable code is actually called.

Endor LabseBPFSnyk+2

AppSec, Supply Chain· Published and added 12 Oct 2026

arxiv.orgpaper🛡️ Security

LLM-based Code Auditing by Inferring and Evaluating Developer Assumptions

Presents Creed, an LLM-based code auditing approach that infers a developer's security-related beliefs for a function, scores how reasonable each is, and derives the conditions under which it is violated. It catches domain-specific semantic flaws that syntactic static analysis misses, such as a timing side-channel that undermines user-enumeration protection. The paper also introduces two measures for explanation-based vulnerability detection, recall and overhead. On a recent real-world benchmark, Creed beats existing explanation-based tools on the effectiveness-effort trade-off.

LLM

Creedtiming side-channeluser enumeration

AI Security, AppSec· Added 15 Oct 2026, published 11 Oct 2026

arxiv.orgpaper🧠 AI

LLM-based Code Auditing by Inferring and Evaluating Developer Assumptions

Presents Creed, an LLM-based code auditing approach that, for a given function, infers the developer's security-related beliefs, scores how reasonable each belief is, and derives the conditions under which it is violated. This lets it find semantic flaws, such as timing side-channels in authentication, that syntactic static analysis tools miss, and it explains root cause, symptoms and exploitability. The paper also introduces two evaluation measures for explanation-based vulnerability detection: recall (how well a known vulnerability is correctly explained) and overhead (the effort of inspecting reports). On a recent real-world benchmark, Creed beats existing explanation-based tools on the effectiveness-effort trade-off.

LLMstatic analysis

CreedarXiv

research, evals· Added 15 Oct 2026, published 11 Oct 2026

x.comthread🛡️ Security

Dan Kornas (@DanKornas) on X

NuGuard is an open-source AI application safety and security toolkit for agentic AI systems, released under Apache 2.0. It unifies AI-SBOM generation, structural static analysis of the AI stack, and sandboxed adversarial red-teaming (100+ scenarios covering prompt injection, tool abuse, and data exfiltration) into a single CLI workflow, with an automated judge that scores findings by impact and provides remediation guidance.

SBOM

AI Security· Published and added 7 Oct 2026

jorgegarciaherrero.compaper🛡️ Security

A Privacy Analysis of Web and Mobile Conversational AI Agents [pdf]

A Proceedings on Privacy Enhancing Technologies paper by IMDEA Networks researchers systematically analyzes the web (via instrumented Chrome/CDP) and Android (via Androguard static analysis plus dynamic instrumentation on a Pixel 3a) clients of nine conversational AI services — ChatGPT, Claude, Grok, DeepSeek, Gemini, Perplexity, Microsoft Copilot, Mistral's Le Chat, and Meta AI. They find every service embeds at least one third-party advertising/tracking service (44 third parties total), that 6/9 web and 3/8 Android clients leak conversation titles, prompts, or screenshots to trackers alongside persistent identifiers, and that several providers expose entire conversations via publicly accessible permalinks lacking access controls. The paper evaluates how consent choices, subscription tiers, and access-control settings shape this exposure and analyzes the practices against GDPR and the ePrivacy Directive, following responsible disclosure to providers and EU DPAs.

ChatGPTClaudeGrok+3

GDPRePrivacy DirectiveAndroid Advertising ID+2

AI Security, Mobile Security, AppSec· Added 2 Oct 2026, published 29 Sep 2026

arxiv.orgpaper🛡️ Security

PYPILINE: Malicious PyPI Package Detection via Suspicious API Knowledge and Agent Workflow

PYPILINE is a malicious PyPI package detection system that builds a structured knowledge base of suspicious APIs from static analysis (AST + API call graphs) of known malicious packages, then uses an LLM agent workflow with RAG to retrieve that knowledge base and perform semantic analysis of new packages, outputting structured evaluation reports. The authors report 96.7% precision, 99.6% recall, and 98.1% F1 (5.7–21.6 points above baseline tools), with ~0.6s average detection time per package under 30 concurrent threads, plus an empirical study of common attack strategies and frequently abused APIs in PyPI malware.

PyPIPythonLLM

Supply Chain, AI Security· Added 26 Sep 2026

arxiv.orgpaper🛡️ Security

Solidity Meets LLMs: A Transformer-Based Approach to Smart Contract Vulnerability Detection

This arXiv paper fine-tunes a BERT-based transformer model on a purpose-built labeled dataset of Solidity code fragments to classify them as vulnerable or safe, reporting a 92% F1 score. It demonstrates applying pre-trained LLM representations to capture Solidity-specific syntactic and semantic patterns for smart contract vulnerability detection, as an alternative or complement to traditional static analysis tools.

SolidityEthereumLLM+1

AI Security, AppSec· Added 4 Oct 2026, published 22 Sep 2026

blog.trailofbits.comwriteup🛡️ Security

Auditing in the age of (good enough) AI

Trail of Bits describes preparing for a six-month audit of the Miden zkVM (a zero-knowledge VM with its own custom assembly language, MASM) by having AI agents (Claude and Codex) build an LSP server, a decompiler, an abstract-interpretation-based static analysis engine, and a Lean formal model of the VM executor, none of which previously existed for MASM. These tools surfaced a high-severity bug in the mod_12289 procedure where an underconstrained prover-supplied advice value allowed a malicious prover to forge Falcon signatures and drain Miden accounts, plus over 400 type-validation issues, while the Lean proof effort produced 95 machine-checked correctness proofs and caught two additional subtle arithmetic bugs (rotr, wrapping_mul) missed by unit tests.

ClaudeCodexVS Code+2

Trail of BitsFalcon

AI Security, AppSec· Published and added 18 Sep 2026

arxiv.orgpaper🛡️ Security

VIPER-MCP paper

VIPER-MCP is an automated auditing framework for Model Context Protocol servers that detects taint-style vulnerabilities in tool handlers and dynamically confirms exploitability via generated proof-of-concept prompts. It uses two-pass static analysis plus feedback-driven prompt evolution, and scanning 39,884 real-world MCP server repos found 106 0-day vulnerabilities with 67 CVE IDs assigned.

Model Context Protocol

VIPER-MCP

AI Security, AppSec, Offensive Security· Added 22 Sep 2026, published 13 Sep 2026

endorlabs.comarticle🛡️ Security

The Most Common Security Vulnerabilities in AI-Generated Code | Blog | Endor Labs

Endor Labs blog post analyzing why LLM-generated code (from tools like GitHub Copilot, Cursor, Replit Ghostwriter) reproduces classic vulnerability patterns from its open-source training data, citing recurring CWE Top 25 weaknesses such as missing input validation (CWE-20), SQL/OS command injection (CWE-89/CWE-78), broken authentication/access control (CWE-306/CWE-284), and hard-coded credentials (CWE-798). It also covers AI-specific risks: dependency explosion from oversized auto-generated dependency trees, stale/vulnerable library suggestions past training cutoff, hallucinated package names enabling slopsquatting attacks, and "architectural drift" where AI edits silently break security invariants without triggering static analysis or code review flags.

GitHub CopilotCursorEndor Labs

CWE-20CWE-89CWE-78+4

AI Security, AppSec, Supply Chain· Published and added 11 Sep 2026

endorlabs.comarticle🛡️ Security

What is VEX and Why Should I Care? | Blog | Endor Labs

Endor Labs explains VEX (Vulnerability Exploitability eXchange), the CISA-backed machine-readable format that lets software producers assert whether a vulnerability in a component actually affects their product, complementing SBOMs which only list components and versions. It walks through how VEX documents annotate exploitability (e.g., unreachable code), and describes how Endor Labs automates this by building a dependency callgraph via static analysis to determine reachability and auto-generate SBOM/VEX documents.

Endor LabsSBOMCVSS+1

CISA

Supply Chain· Published and added 11 Sep 2026

x.comthread🛡️ Security

Pyro (@0x3b33) on X

A roundup of three open-source AI-assisted smart contract security scanners: pashov/skills (solidity-auditor + x-ray pre-audit + fuzz suite generation, fast/cheap feedback), PlamenTSV's autonomous 8-phase agent covering EVM, Solana, and Move that ships PoCs with findings, and Trail of Bits' skills repo with 40+ security skills for contract audits, differential review, and static analysis. Useful pointer to emerging AI-agent-based smart contract auditing tooling.

SolidityEthereumSolana+1

AppSec, AI Security· Published and added 7 Sep 2026

endorlabs.comarticle🛡️ Security

The Secure Agentic Development Lifecycle (ADLC), Explained | Blog | Endor Labs

Endor Labs defines the "agentic development lifecycle" (ADLC) — the process by which AI coding agents autonomously plan, write, test, and ship code — and lays out where it introduces new security risk: insecure-by-default code, architectural design flaws that pass static analysis, hallucinated/unvetted dependencies, and a review bottleneck as agents outpace human reviewers. It cites benchmark data (62% of best-model BaxBench solutions insecure, only 10.5% of SWE-Agent/Claude 4 Sonnet solutions secure, only 1 in 5 AI-recommended dependency versions safe) and proposes a control stack — secure-generation prompting, security-aware multi-agent PR review, reachability-based prioritization, and automated remediation — mapped to NIST SP 800-218A, CSA's Agentic SDLC, and OWASP.

Model Context ProtocolCursorClaude Code+3

BaxBenchSWE-AgentNIST SP 800-218A+4

AI Security, Supply Chain, DevSecOps· Added 3 Sep 2026, published 2 Sep 2026

endorlabs.comarticle🛡️ Security

AI Code Review: How to Actually Review Code an Agent Wrote | Blog | Endor Labs

Endor Labs explainer on "AI code review" as a discipline: pairing LLM reasoning with static analysis (call graphs, data flow) to catch security-relevant PR changes that AI coding agents introduce, alongside human reviewers. It cites research showing common AI-generated flaws (missing input validation CWE-20/89/78, hardcoded secrets CWE-798, broken auth CWE-306/284, hallucinated/insecure dependencies), Endor's finding that under 9.5% of vulnerabilities are reachable/exploitable, and a comparison of AI review against SAST, SCA, and secrets scanning, plus a rollout checklist referencing NIST SP 800-218A.

Endor LabsGitHubGitLab+3

CWE-20CWE-89CWE-78+5

AI Security, AppSec· Added 3 Sep 2026, published 2 Sep 2026

endorlabs.comarticle🛡️ Security

SAST for AI-Generated Code: What Static Analysis Catches and Misses | Blog | Endor Labs

Endor Labs blog post arguing traditional signature-based SAST misses the logic and business flaws AI coding assistants introduce, since those flaws are "not pattern-shaped." It contrasts AI-assisted SAST (rules plus a thin AI layer) with AI-native SAST that traces dataflow across files and uses reachability analysis plus evidence-based triage to cut false positives, citing that Endor Labs' own tool (built on Opengrep with AI-agent triage) found a zero-day, CVE-2026-55407, in Anthropic's Rust buffa library and that only ~1 in 5 AI-recommended dependency versions are safe.

Endor LabsOpengrepRust

CVE-2026-55407OWASP Top 10 for LLM Applicationsslopsquatting+2

AppSec, AI Security, Supply Chain· Added 3 Sep 2026, published 2 Sep 2026

aikido.devarticle🛡️ Security

The dark figure of supply chain detection

Aikido Security argues that string/IOC-based malware detection suffers from survivorship bias (the 'dark figure' of undetected supply-chain attacks) and proposes an adapted version of David Bianco's Pyramid of Pain for package ecosystems, where durable detection requires behavioral baselines mapped per package type rather than hashes or known-bad strings. It illustrates the approach with a real incident: a malicious version of the popular npm package Keyv (600M+ downloads) that executed obfuscated JS, downloaded the Bun runtime, and ran a second obfuscated payload at install time, caught by behavioral/technique-level analysis in Aikido's sandbox despite heavy obfuscation defeating static analysis.

npmBunAikido Security+2

Pyramid of PainDavid Biancokeyv

Supply Chain, Blue Team & Detection· Added 3 Sep 2026, published 1 Sep 2026

endorlabs.comarticle🛡️ Security

Why C Has Always Broken Static Analysis | Blog | Endor Labs

Endor Labs analyzes four structural reasons C/C++ static analysis has historically underperformed: preprocessor/build dependence, hard pointer-aliasing tradeoffs (over- vs under-approximation), pattern rules poorly suited to length/lifetime bugs vs. web-style source-sink flaws, and the lack of dominant frameworks to model (unlike Spring for Java). It cites a study of 8,918 C++ programs showing LLM-generated code triggers confirmed runtime memory-safety violations (CWE-190, -122, -121) at 3.6x the human rate, bugs invisible to static-only CI gates and only caught by sanitizers/model checking. It surveys existing analyzer approaches (Coverity/Klocwork/CodeSonar build-based, Veracode binary-based, build-less scanners, generalist multi-language SAST) and their tradeoffs.

CCoverityKlocwork+2

AppSec· Added 3 Sep 2026, published 25 Aug 2026

opensourcemalware.comtalk🛡️ Security

The OpenSourceMalware Show #17

Episode 17 of The OpenSourceMalware Show covers GitHub's move to revoke npm granular access tokens that could bypass 2FA, and follows up on the DPRK NullReceiver obfuscation technique (now found in well over the 7 originally confirmed packages, overlapping with the PolinRider campaign). The hosts also discuss why malicious AI 'skills' are hard to detect via static analysis due to their natural-language format, note DPRK's use of crypto payments (e.g. via Astrill VPN, hosting provider Evoxt) as a potential tracking vector for defenders, and touch on MCP server risk being more about vulnerabilities than outright malware.

npmGitHubModel Context Protocol+1

NullReceiverPolinRiderDPRK+6

Threat Intel, Supply Chain, AI Security· Added 3 Sep 2026, published 14 Aug 2026

github.comrepo🛡️ Security

Static Analysis Tools & Linters

analysis-tools.dev's source repository is a community-maintained directory of static analysis tools and linters spanning nearly every programming language, tagged for license (proprietary vs open source), maintenance status, and community endorsement. Beyond general code-quality linters, it catalogs many security-relevant static analyzers such as gosec, flawfinder, OWASP Dependency Check, Mariana Trench, Psalm, PHPStan, govulncheck, and WAP, making it a reference point for discovering SAST tooling per language/ecosystem.

GoPHPJava+3

AppSec· Added 3 Sep 2026, published 9 Aug 2026

github.comrepo🛡️ Security

Slither

Slither, developed by Trail of Bits, is a Python3-based static analysis framework for Solidity and Vyper smart contracts that runs a suite of vulnerability detectors, visualizes contract internals via 'printers', and exposes an API for writing custom analyses using its SlithIR intermediate representation. It integrates into Hardhat/Foundry/Brownie builds and CI (including GitHub code scanning), claims 99.9% parse coverage of public Solidity code and sub-second average analysis time per contract, and ships companion tools like slither-check-upgradeability, slither-prop, and slither-read-storage.

SolidityPythonFoundry+3

Trail of Bits

AppSec· Published and added 31 Jul 2026

github.comrepo🛡️ Security

YuroGod/VMPStaticUnpacker

VMPStaticUnpacker is a Python tool that statically unpacks VMProtect-protected Windows PE binaries without executing them, supporting both the legacy plaintext PACKER_INFO metadata format and the compact rotating-XOR format seen in VMProtect 3.9.5 PE32+ samples. It recovers the destination key by XORing the encoded destination with the first packed section's RVA and rolling the key with ROL32(key,7), then validates candidate tables and LZMA streams before rebuilding a memory-image PE for static analysis. It does not devirtualize protected code, recover the original entry point, strip the VMProtect runtime, or fix imports.

VMProtectPythonWindows

oureveryday/VMPUnpacker

Malware & RE· Added 2 Oct 2026, published 29 Jul 2026

appsec.guidearticle🛡️ Security

Rust

Part of appsec.guide's language-specific security guide series, this page is the entry point for Rust security review, covering dynamic analysis, static analysis, memory zeroization, gotchas and footguns, model checking, specialized testing, and supply chain analysis. It points readers to a 'rust-review' skill/checklist as the starting point for auditing Rust codebases.

RustCargocrates.io

AppSec, Supply Chain· Published and added 24 Jul 2026

securityweek.comarticle🛡️ Security

AI Security Briefing

Mozilla's 0Din researchers describe an attack where a benign-looking repository causes Claude Code to spawn a reverse shell during normal first-time setup. A deliberately broken Python package throws an error instructing the agent to run 'python3 -m axiom init', which triggers a setup.sh script that pulls a base64-encoded command from a DNS TXT record and executes it, opening an interactive shell that can exfiltrate credentials and install a backdoor. The technique splits malicious intent across three systems (repo, DNS infrastructure, and the agent's trust in error-driven remediation) so that no single component looks malicious to static analysis, network monitoring, or the agent itself.

Claude CodePython

Mozilla 0Din

AI Security, Offensive Security· Published and added 18 Jul 2026

blog.trailofbits.comarticle🛡️ Security

Rust-proof your code with our new Testing Handbook chapter

Trail of Bits announces a new chapter of its Testing Handbook dedicated to security testing Rust programs, covering Rust's safety-guarantee gaps (unwind safety, arithmetic errors, nondeterminism), dynamic analysis with Miri and proptest, static analysis with Clippy, a gotchas/footguns checklist for manual review, memory zeroization techniques, model checking with Kani, and supply-chain dependency vetting. The post also announces rust-review, a Claude Code plugin co-built with Aptos Labs that automates detection of over a dozen Rust bug classes including memory safety, concurrency, FFI, and async cancellation issues.

RustClaude CodeCargo

Trail of BitsAptos Labs

AppSec· Added 3 Sep 2026, published 13 Jul 2026

github.comrepo🛡️ Security

DataDog/guarddog

GuardDog is DataDog's CLI tool that scans PyPI, npm, Go modules, Rust crates, RubyGems, GitHub Actions, and VSCode extensions for malicious packages using YARA-based static analysis and registry metadata detectors. It correlates code capabilities with threat indicators (mapped to MITRE ATT&CK stages) to produce a 0-10 risk score, aiming to reduce alert fatigue compared to traditional SAST tools, and runs archive extraction and source analysis inside a kernel-level sandbox (Landlock/Seatbelt via nono) to mitigate path-traversal/code-execution vulnerabilities such as CVE-2022-23530, CVE-2022-23531, CVE-2026-22870, and CVE-2026-22871.

PyPInpmGitHub Actions+3

CVE-2022-23530CVE-2022-23531CVE-2026-22870+1

Supply Chain, DevSecOps, Blue Team & Detection· Published and added 11 Jul 2026

github.comrepo🛡️ Security

SyscallX-18113/Apkx-Hunter

APKX-Hunter is an open-source Android static analysis framework written in C, built for reverse engineering, malware analysis, OWASP MASVS compliance scanning, and bug bounty/pentesting work. It decompiles APK/APKM/APKS/XAPK/ZIP packages via JADX or APKTool, extracts hardcoded secrets, endpoints, permissions, exported components, and native libraries, and scores detected secrets with a lightweight offline C-based ML classifier (166 MASVS detection patterns across 15 categories). It was showcased at Black Hat Europe Arsenal and tested against the OWASP UnCrackable Level 4 app.

AndroidCLinux

OWASP MASVSOWASP UnCrackable Level 4

Mobile Security, AppSec· Added 30 Sep 2026, published 11 Jul 2026

Showing 30 of 38