Secure code review is critical at the pre-commit stage, where vulnerabilities must be caught early under tight latency and limited-context constraints. Existing SAST-based checks are noisy and often miss immature, context-dependent vulnerabilities, while standalone Large Language Models (LLMs) are constrained by context windows and lack explicit tool use. Agentic AI, which combine LLMs with autonomous decision-making, tool invocation, and code navigation, offer a promising alternative, but their effectiveness for pre-commit secure code review is not yet well understood. In this work, we introduce AgenticSCR, an agentic AI for secure code review for detecting immature vulnerabilities during the pre-commit stage, augmented by security-focused semantic memories. Using our own curated benchmark of immature vulnerabilities, tailored to the pre-commit secure code review, we empirically evaluate how accurate is our AgenticSCR for localizing, detecting, and explaining immature vulnerabilities. Our results show that AgenticSCR achieves at least 153% relatively higher percentage of correct code review comments than the static LLM-based baseline, and also substantially surpasses SAST tools. Moreover, AgenticSCR generates more correct comments in four out of five vulnerability types, consistently and significantly outperforming all other baselines. These findings highlight the importance of Agentic Secure Code Review, paving the way towards an emerging research area of immature vulnerability detection.
翻译:安全代码审查在预提交阶段至关重要,该阶段必须在严格的延迟和有限上下文约束下尽早捕获漏洞。现有的基于静态应用程序安全测试(SAST)的检查噪声较大,且常常遗漏不成熟的、依赖于上下文的漏洞,而独立的大型语言模型(LLM)则受限于上下文窗口且缺乏显式的工具使用能力。智能体人工智能(Agentic AI)将LLM与自主决策、工具调用和代码导航相结合,提供了一种有前景的替代方案,但其在预提交安全代码审查中的有效性尚未得到充分理解。在本工作中,我们提出了AgenticSCR,一种用于安全代码审查的智能体人工智能,旨在预提交阶段检测不成熟漏洞,并通过聚焦安全领域的语义记忆进行增强。利用我们专门为预提交安全代码审查定制的、自行构建的不成熟漏洞基准测试集,我们实证评估了AgenticSCR在定位、检测和解释不成熟漏洞方面的准确性。我们的结果表明,与基于静态LLM的基线方法相比,AgenticSCR生成的正确代码审查意见相对百分比至少高出153%,并且也显著超越了SAST工具。此外,在五类漏洞类型中的四类中,AgenticSCR均能生成更多正确意见,始终且显著优于所有其他基线方法。这些发现凸显了智能体安全代码审查的重要性,为不成熟漏洞检测这一新兴研究领域的发展铺平了道路。