Local ai agents find software vulnerabilities better than some cloud models
AgenticVulHunter: Bringing Local Agentic Vulnerability Hunting to Your Terminal
Cryptography and SecuritySoftware Engineering
Summary
Finding security problems in software early helps prevent attacks, but it’s hard because the issues can be spread across many files. The authors created AgenticVulHunter, a tool that uses locally run open-source AI models to review code for security flaws. They tested it on hundreds of examples and found that it is more accurate than previous methods that rely on commercial AI services. This shows local AI models can effectively help find code vulnerabilities with focused security knowledge.
What this means in practice
- •For software security teams: Use AgenticVulHunter to detect vulnerabilities across multiple code files during code review using local AI models.
- •For devops engineers: Integrate a local AI agent to automate early vulnerability detection in development pipelines without relying on cloud services.
Authors
Nishant Abhishek, Ping Charoenwet, Kla Tantithamthavorn
Abstract
Finding vulnerabilities early, before they can affect the production system, is important for reducing the risk of any software attacks. However, detecting vulnerabilities during secure code review is still difficult because the vulnerable code logic may depend on lines found across different repository files. Recent approaches such as AgenticSCR have shown that LLM agents can explore repository files and use security knowledge to improve secure code review. However, these approaches mainly rely on external commercial LLMs and can provide a large amount of security knowledge to the agent at once. This creates an important question of whether agentic secure code review can also be performed effectively using locally deployed open-weight LLMs with more focused and relevant security knowledge. In this paper, we propose AgenticVulHunter, an agentic secure code review approach and tool that can run with a locally deployed open-weight LLM. We evaluate AgenticVulHunter on 144 vulnerability cases from SCRBench using Qwen3-Coder-30B and DeepSeek V3.1 Terminus. We measure what percentage of generated review comments correctly identify the vulnerable location, match the vulnerability type, and provide a relevant security review comment together. AgenticVulHunter achieves an accuracy of 18.4% with Qwen3- Coder-30B and 23.8% with DeepSeek V3.1 Terminus, compared with 11.8% for our AgenticSCR-style reproduction using Qwen3-Coder-30B and 17.5% for AgenticSCR using Claude Sonnet 4.