LLM-based security tools struggle at scale, study finds—despite high recall on simple code

Researchers conducting the first large-scale empirical study of machine-learning-based vulnerability detection have uncovered significant practical limitations in current tools, even as they outperform traditional static analyzers in some metrics.

The study, published on arXiv, tested five specialized LLM-based detectors and two general-purpose AI agents against four conventional static analysis tools. The evaluation covered 265 known C/C++ and Java security flaws across 24 real-world open-source projects, with researchers manually reviewing over 6,400 flagged warnings to understand what went wrong.

What the tools got right—and wrong#

General-purpose AI agents achieved the highest recall rate—meaning they caught the most vulnerabilities—but stumbled badly when analyzing intricate code. Both AI-based and traditional analyzers struggled to accurately model APIs and dependencies, a fundamental requirement for spotting security issues that span multiple function calls.

When deployed on actual projects, all tools showed concerning false-positive rates. The researchers identified two dominant reasons: truncated or incomplete tracking of code execution paths between functions, and incorrect identification of where in the code a vulnerability actually occurs. AI-based tools added their own failure modes, including logical reasoning breakdowns and failures to follow prompt instructions.

The hidden cost of AI-powered scanning#

Behind the technical failures lies an economic problem. Running LLM-based vulnerability detectors on a single project consumes hundreds of thousands to hundreds of millions API tokens. Per-project costs exceed $1,000, with total scanning times stretching from hours to days. Traditional static analyzers, by contrast, operate much faster and at zero API cost—though they find fewer vulnerabilities.

Why it matters#

The findings signal that despite AI's promise in security, current approaches are not yet ready for widespread deployment at production scale. Organizations considering LLM-based tools must weigh genuine detection gains against unreliability on complex code, prohibitive costs, and slow analysis times. The researchers point toward better context management, more robust reasoning, and improved API modeling as necessary improvements.