{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/arxiv-2601-19138","title":"AgenticSCR: An Autonomous Agentic Secure Code Review for Immature Vulnerabilities Detection","arxiv_id":"2601.19138","date":"2026-01-27","proceeding":null,"authors":["Wachiraphan Charoenwet","Kla Tantithamthavorn","Patanamon Thongtanunam","Hong Yi Lin","Minwoo Jeong","Ming Wu"],"abstract":"Secure code review is critical during pre-integration, where Atlassian developers rely on lightweight analysis tools, while deep security assessment is deferred to later stages, delaying feedback and increasing remediation costs. Existing static analyzers are often noisy and struggle with context-dependent or partially manifested vulnerabilities, while static large language model (LLM) reviewers are constrained by context windows and lack tool interaction. Agentic AI, which combines LLMs with code navigation, shows promise; however, its effectiveness for early-stage secure code review remains underexplored. We present AgenticSCR, an agentic secure code reviewer augmented with security-focused semantic memory that grounds reasoning in structured security knowledge to detect vulnerabilities before they fully manifest. AgenticSCR achieves at least 153% relative improvement in generating comments with correct localization, vulnerability type, and relevance over static LLM baseline, multi-agent reviewer, and SAST tools. In a shadow deployment, 54% of its comments were validated by security engineers for developer reporting, demonstrating practical utility while underscoring the difficulty of the task. These findings position the security-focused semantic memory as a promising direction for agentic secure code review, enabling early-stage vulnerability identification. Our approach builds an important step toward reliable localization, detection, and explanation in shift-left security practices","url_abs":"https://arxiv.org/abs/2601.19138","url_pdf":"https://arxiv.org/pdf/2601.19138","source":{"archive":null,"snapshot":"2025-07-28","note":"not in the Papers with Code archive (frozen at the snapshot)","row_kind":"graph","title_abstract_authors_date":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)"},"code_links":[],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2601.19138","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2601.19138"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"mentioned_in_github":null,"is_official":null,"provenance":"deterministic:regex_extraction","mentioned_in_paper":null,"url":"https://github.com/bbangert/beaker","reach":null}],"summary":{"unverified":8},"by_repo_kind":{"found_in_text":{"samples":8,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":8,"samples":[{"code_sha256_prefix":"f96ebc7d08f4bf55","entry":"asbool","repo":"bbangert/beaker","repo_kind":"found_in_text","path":"beaker/converters.py","file_url":"https://github.com/bbangert/beaker/blob/HEAD/beaker/converters.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"f96ebc7d08f4bf55"}},{"code_sha256_prefix":"bbd43e7a82e44025","entry":"aslist","repo":"bbangert/beaker","repo_kind":"found_in_text","path":"beaker/converters.py","file_url":"https://github.com/bbangert/beaker/blob/HEAD/beaker/converters.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"bbd43e7a82e44025"}},{"code_sha256_prefix":"5843eec3e0f9a99b","entry":"b64decode","repo":"bbangert/beaker","repo_kind":"found_in_text","path":"beaker/_compat.py","file_url":"https://github.com/bbangert/beaker/blob/HEAD/beaker/_compat.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"5843eec3e0f9a99b"}},{"code_sha256_prefix":"4a3291a87bbdbc1d","entry":"b64encode","repo":"bbangert/beaker","repo_kind":"found_in_text","path":"beaker/_compat.py","file_url":"https://github.com/bbangert/beaker/blob/HEAD/beaker/_compat.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"4a3291a87bbdbc1d"}},{"code_sha256_prefix":"5c2402d8b747a50e","entry":"bytes_","repo":"bbangert/beaker","repo_kind":"found_in_text","path":"beaker/_compat.py","file_url":"https://github.com/bbangert/beaker/blob/HEAD/beaker/_compat.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"5c2402d8b747a50e"}},{"code_sha256_prefix":"6a230197c97c9784","entry":"function_named","repo":"bbangert/beaker","repo_kind":"found_in_text","path":"beaker/util.py","file_url":"https://github.com/bbangert/beaker/blob/HEAD/beaker/util.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"6a230197c97c9784"}},{"code_sha256_prefix":"2791c339bb8ee5c5","entry":"has_self_arg","repo":"bbangert/beaker","repo_kind":"found_in_text","path":"beaker/util.py","file_url":"https://github.com/bbangert/beaker/blob/HEAD/beaker/util.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"2791c339bb8ee5c5"}},{"code_sha256_prefix":"5a46e86e50b803c9","entry":"skip_if","repo":"bbangert/beaker","repo_kind":"found_in_text","path":"beaker/util.py","file_url":"https://github.com/bbangert/beaker/blob/HEAD/beaker/util.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"5a46e86e50b803c9"}}]},"arxiv_metadata":{"licence":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)","fields":["title","abstract","authors","date"],"primary_category":"cs.LG","source":"arxiv_2026.jsonl"},"syntology_extracted_results":null}