Security skills only partially help AI find Linux kernel flaws
How Effectively Do Security Skills Guide Coding Agents in Vulnerability Detection in Linux Kernel?
Cryptography and SecuritySoftware Engineering
Summary
Finding bugs in complex software like the Linux kernel is hard, especially for AI agents trying to help. The authors studied how well these AI tools, using special security techniques, detect real vulnerabilities. They found that while the AI could sometimes spot the right part of the code, fully correct vulnerability detection was rare. By learning from its mistakes over time, the AI improved, but there is still much room for improvement in understanding and verifying security issues.
What this means in practice
- •For security auditors: Use evolving AI skills to improve automation in identifying complex software vulnerabilities previously missed.
- •For software security tool developers: Incorporate failure-driven learning frameworks to enhance AI-based vulnerability detection features in development tools.
Authors
Haoran Xue, Nikta Akbarpour, Gias Uddin, Song Wang
Abstract
Large language model (LLM) coding agents, such as Claude Code, are increasingly used for security auditing, with task-specific skills providing reusable vulnerability-analysis procedures. However, their effectiveness in detecting real vulnerabilities and the reasons for their failures remain unclear. We conduct the first large-scale empirical study of 37 security skills using Claude Code with four underlying LLMs on 100 real Linux kernel vulnerabilities across ten classes, totaling 14800 runs. We evaluate vulnerability detection at the function, statement, and vulnerability-class levels. Results show that 24.4 percent of runs locate the correct function, 18.3 percent identify both the function and responsible statement, and 15.7 percent correctly classify the vulnerability. Our failure analysis reveals limitations in evidence acquisition, state-relation reasoning, code interpretation, candidate verification, investigation coverage, and reporting. Based on these findings, we propose SKILL-SIF, a self-improving framework that iteratively evolves security skills by learning from missed vulnerabilities and failure patterns. We evolve five top-performing skills using the original benchmark and evaluate them on 100 previously unseen vulnerabilities. SKILL-SIF improves fully correct vulnerability detection by up to eight times (from 2 percent to 16 percent) on unseen vulnerabilities, while aggregate accuracy across four LLMs increases by 1.85 times (from 6.05 percent to 11.20 percent). These findings highlight the limitations of existing security skills and demonstrate the potential of failure-driven skill evolution to improve vulnerability detection in coding agents.