# Bug Detection

3 related articles

Subscribe to updates

arXiv Nov 11, 2026
Symbolic execution stops stalling on environment setup: an AI agent supplies the database model, lifting CrossHair's executable functions from 4.5% to 81%
CrossHair, a symbolic execution tool, barely runs on real Python web applications because the code ships without contracts and its database calls cannot be executed symbolically. A pipeline pairing an AI coding agent with CrossHair automatically writes contracts for functions and synthesizes a symbolic model of the database, raising the share of executable functions from 4.5% to 81% across 11 open-source applications and 1,156,044 lines of code, and finding 221 bugs reproduced by tests. These bugs are mostly input-domain corner cases, and some are missed by direct inspection with the same model.
CrossHair, a symbolic execution tool, barely runs on real Python web applications because the code ships without contracts and its database calls cannot be executed symbolically. A pipeline pairing an AI coding agent with CrossHair automatically writes contracts for functions and synthesizes a symbolic model of the database, raising the share of executable functions from 4.5% to 81% across 11 open-source applications and 1,156,044 lines of code, and finding 221 bugs reproduced by tests. These bugs are mostly input-domain corner cases, and some are missed by direct inspection with the same model.
George Granberry（First author）
Symbolic Execution Executable Environment Synthesis CrossHair Coding agent Bug Detection
arXiv Oct 26, 2026
Coding agents hunt bugs on their own, but PROBE finds the best configuration recovers only 20.8% of the bugs maintainers fixed
The PROBE benchmark uses 2,457 bugs that maintainers fixed over 18 months in snapshots of 20 GitHub repositories as a reference, and asks whether coding agents can find those bugs autonomously across a whole repository. Across ten frontier models under a partitioned audit harness, the best configuration recovers only 20.8% of the reference bugs with precision no higher than 8.1%, yet an independent panel confirms 84% of findings that do not match the reference set as real bugs, showing that agents find a different distribution of bugs than maintainers fix.
The PROBE benchmark uses 2,457 bugs that maintainers fixed over 18 months in snapshots of 20 GitHub repositories as a reference, and asks whether coding agents can find those bugs autonomously across a whole repository. Across ten frontier models under a partitioned audit harness, the best configuration recovers only 20.8% of the reference bugs with precision no higher than 8.1%, yet an independent panel confirms 84% of findings that do not match the reference set as real bugs, showing that agents find a different distribution of bugs than maintainers fix.
Marco Paina（First author）
PROBE Bug Detection Coding agent
arXiv Oct 12, 2026
Code review agents lifted bug catch rate from 47.7% to 71.9% in five months, but weaken on proprietary repositories
CRBugBench tests code review agents against 1,800 human-fixed bugs: the best configuration catches 79.6% of pre-merge bugs within its top-5 comments, but performance drops noticeably on proprietary industry repositories.
Microsoft (United States)
Chenyang Yang（First author）
CRBugBench Code Review Agents Bug Detection code review

You’re all caught up

Symbolic execution stops stalling on environment setup: an AI agent supplies the database model, lifting CrossHair's executable functions from 4.5% to 81%

Coding agents hunt bugs on their own, but PROBE finds the best configuration recovers only 20.8% of the bugs maintainers fixed

Code review agents lifted bug catch rate from 47.7% to 71.9% in five months, but weaken on proprietary repositories