Machine Learning's Vulnerability-Detection Problem: Why a Decade of AI Hasn't Improved Code Security

Finding security flaws in code by hand is expensive and can't keep pace with modern development—especially as automated coding systems churn out ever more code. Over the past ten years, researchers have poured effort into applying machine learning to automate vulnerability detection, yet the results on benchmark datasets tell a troubling story: there's no meaningful improvement over time.

The Core Problem#

A new survey examining 87 influential research papers exposes why. The machine learning for automated vulnerability detection (ML4AVD) field has accumulated technical critiques of its datasets, metrics, and problem setup—but these issues exist in isolation. The real issue is deeper: a web of self-reinforcing feedback loops that bind together dataset choices, problem formulations, baseline methods, and evaluation metrics. These loops lock the entire research community into solving a narrow, artificial version of the problem.

Where the Field Got Stuck#

The evidence is striking. Research has zeroed in on a single formulation: binary classification of C/C++ vulnerabilities at the function level. This narrow focus leaves out three crucial aspects of real-world security work:

• Predicting what type of vulnerability exists
• Supporting programming languages beyond C/C++
• Separating the granularity at which code is analyzed from the granularity at which vulnerabilities are detected

These aren't oversights—they're consequences of how the feedback loops operate. Researchers gravitate toward established datasets and metrics because they enable publication and comparison. Those datasets and metrics reinforce a particular problem framing. That framing becomes the default. And so the cycle perpetuates.

Twelve Pain Points, All Connected#

The survey identifies twelve distinct problems spanning the entire ML4AVD pipeline, each reinforcing the others. The authors pair each with concrete recommendations aimed at breaking the feedback loops—steps toward research that tackles more complex, realistic vulnerability detection challenges.

Implications for Agentic AI#

The timing of this analysis is significant. As AI systems grow more capable at autonomous code generation, the limitations of current ML-based vulnerability detection become increasingly urgent. The survey includes a case study of AIxCC, a recent high-profile initiative, to assess whether it avoids these pitfalls. The authors also reflect on whether machine learning approaches to vulnerability detection remain relevant as agentic AI systems reshape how code is produced.