Research / Papers
4 selected co-authored preprints on AI agents and software security. These works are available on arXiv; a preprint listing does not imply peer review.
An evaluation of deterministic SAST and AI security agents on 108 vulnerabilities across 20 open-source applications, examining coverage, harness policy, and cost. Snyk Code and Claude Code’s strongest evaluated configuration together covered 101 of 108 vulnerabilities.
A benchmark of 307 dependency upgrades across 43 repositories, evaluating whether AI agents fix vulnerabilities while preserving successful builds and tests.
Repeated vulnerability scans on JavaScript code explore the consistency of LLM security review and how it complements deterministic static analysis.
An analysis of 3,984 agent skills, documenting malicious payloads, credential theft, and the security risks of emerging skill marketplaces.