🤖 AI Summary
This study systematically evaluates the reproducibility and stability of large language models (LLMs) in repeatedly performing JavaScript security scanning tasks. Drawing on 300 repeated experiments using LLMs such as Claude, the Snyk Code static analysis tool, and a newly developed benchmark—Snyk VulnBench JS 1.0—the work provides the first quantitative evidence that LLMs exhibit high stability in detecting reference vulnerabilities (134 out of 158 consistently reproduced within five trials), while showing significant inconsistency for non-matching vulnerabilities (only 22 out of 161 stably detected). Beyond uncovering potential blind spots in Snyk Code, the research proposes a novel paradigm of complementary collaboration between LLMs and static application security testing (SAST), demonstrating that hybrid approaches effectively enhance the comprehensiveness of vulnerability detection.
📝 Abstract
We ran 300 repeated vulnerability-finding scans to measure how repeatable agentic large language model (LLM) security review is on the same JavaScript code, prompt, and benchmark harness. The headline result is that LLM security findings were unevenly repeatable: reference-matched findings were stable, but extra model reports varied heavily from run to run. Across 250 model runs, 80 of 161 unique unmatched findings appeared in only one of five identical repetitions, while only 22 appeared in all five. By contrast, when Claude matched a Snyk Code reference finding, the behavior was much more stable: 134 of 158 unique reference-matched findings appeared in all five repetitions. The benchmark also shows complementarity. Models consistently found familiar, high-signal exploit shapes, and in one case surfaced a likely Snyk Code product gap. Snyk Code static application security testing (SAST) was deterministic and better at systematically enumerating repeated data-flow sinks. The results support combining agentic LLM review with deterministic SAST rather than treating either technique as a replacement for the other.