一句话：提出带安全语义记忆的智能体代码审查器，在早期漏洞检测中显著优于静态LLM、多智能体与SAST工具。
安全代码审查在预集成阶段至关重要：Atlassian 开发者依赖轻量分析工具，深度安全评估被推迟，导致反馈延迟与修复成本上升。现有静态分析器噪声大，难以处理上下文相关或尚未完全显现的漏洞；静态 LLM 审查器受上下文窗口限制且无法与工具交互。为此，作者提出 AgenticSCR——一个增强安全语义记忆的智能体式安全代码审查器，将推理建立在结构化安全知识之上，以在漏洞完全显现之前进行检测。评估显示，相比静态 LLM 基线、多智能体审查器与 SAST 工具，AgenticSCR 在生成同时具备正确本地化、漏洞类型与相关性的评论上至少取得 153% 的相对提升。在影子部署中，54% 的评论被安全工程师确认可用于开发者报告，表明其实际效用，同时也凸显了任务难度。该工作表明安全语义记忆是智能体安全代码审查的有前景方向，推动 shift-left 安全中的可靠定位、检测与解释。
Secure code review is critical during pre-integration, where Atlassian developers rely on lightweight analysis tools, while deep security assessment is deferred to later stages, delaying feedback and increasing remediation costs. Existing static analyzers are often noisy and struggle with context-dependent or partially manifested vulnerabilities, while static large language model (LLM) reviewers are constrained by context windows and lack tool interaction. Agentic AI, which combines LLMs with code navigation, shows promise; however, its effectiveness for early-stage secure code review remains underexplored. We present AgenticSCR, an agentic secure code reviewer augmented with security-focused semantic memory that grounds reasoning in structured security knowledge to detect vulnerabilities before they fully manifest. AgenticSCR achieves at least 153% relative improvement in generating comments with correct localization, vulnerability type, and relevance over static LLM baseline, multi-agent reviewer, and SAST tools. In a shadow deployment, 54% of its comments were validated by security engineers for developer reporting, demonstrating practical utility while underscoring the difficulty of the task. These findings position the security-focused semantic memory as a promising direction for agentic secure code review, enabling early-stage vulnerability identification. Our approach builds an important step toward reliable localization, detection, and explanation in shift-left security practices.
@inproceedings{abs-2601-19138,
title = {AgenticSCR: An Autonomous Agentic Secure Code Review for Immature Vulnerabilities Detection},
author = {Wachiraphan Charoenwet and Kla Tantithamthavorn and Patanamon Thongtanunam and Hong Yi Lin and Minwoo Jeong and Ming Wu},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3834523}
}