cs.AIAug 21, 2026

Large Language Models at the Intersection of Software Engineering and Software Security:An Evidence-Centered Structured Survey and Research Agenda

Authors: Wei Lin, Tao Zhou, Zhaofei Xie, Changgui Hong

Organizations: Nanjing Liancheng Intelligent Technology Group, Nanjing, China

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Large Language Models (LLMs) are moving from code completion toward repository-scale agents that retrieve context, edit files, execute tools, and participate in security-sensitive workflows. The evidence for these systems, however, remains divided between software engineering evaluations centered on functional task completion and software security evaluations centered on vulnerability detection, secure generation, or exploit-oriented validation. This evidence-centered structured survey synthesizes representative work available through May 31, 2026 across software engineering tasks, software security tasks, adaptation mechanisms, artifact granularity, and evaluation design. In addition to a task taxonomy, we introduce an assurance framework that separates functional correctness, security, operational reliability, evidence provenance, and agent authority. The review shows that execution feedback and repository access can substantially improve engineering task completion, but do not by themselves establish security; conversely, static-analysis labels or vulnerability-classification scores rarely establish deployable correctness. We identify recurring validity threats--weak test oracles, duplicated and temporally leaked data, changing agent harnesses, proxy-only security checks, and under-reported budgets and human intervention--and derive a minimum reporting protocol for cross-study comparison. The resulting research agenda prioritizes jointly secure-and-functional benchmarks, repository-scale threat models, calibrated human oversight, longitudinal maintainability evidence, and reproducible agent evaluation. The central conclusion is that model capability should be judged as an assurance case supported by task-appropriate evidence, rather than by a single benchmark score.

Figures & tables

SurveyYearSESecurityAgenticBenchmarksIntersection
Hou et al. [ 4 ]2024∙\bullet∘\circ–∘\circ∘\circ
Xu et al. [ 8 ]2025–∙\bullet∘\circ∘\circ∘\circ
Zhou et al. [ 9 ]2024–∙\bullet–∘\circ∘\circ
Guo et al. [ 6 ]2025∙\bullet–∙\bullet∙\bullet–
Gao et al. [ 14 ]2025∙\bullet∘\circ––∘\circ
Basic and Giaretta [ 11 ]2026∘\circ∙\bullet∘\circ∘\circ∘\circ
Table 1: Comparison with representative surveys. ∘\circ = covered as a sub-topic; ∙\bullet = primary focus; – = not emphasized.
Figure 1: Unified taxonomy of LLM4SE and LLM4Security. The hierarchy separates engineering tasks, security tasks, and adaptation strategies; colors distinguish node roles and adaptation families.
Figure 2: Timeline of key LLM developments for code (2020–2026). Colors denote architectural paradigms.
Source/SystemSettingResolved (%)Interpretation
Jimenez et al. [ 12 ]Original benchmark baseline1.96Limited repository-level issue resolution
Bhati et al. [ 20 ]Later agentic result reported in review78.4Stronger models, retrieval, tools, and iterative execution
Table 3: Illustrative SWE-bench results reported by primary and secondary sources. The rows are not directly comparable because evaluation configurations differ.
CategoryBenchmarkPrimary Task
Code GenerationHumanEval/HumanEval+Function-level (Python)
MBPPFunction-level (Python)
SWE-bench VerifiedRepository-level
DS-1000Data science code
BigCodeBench/LiveCodeBenchMulti-library/Continuous
RepairDefects4JReal-world Java bugs
Table 4: Key benchmarks for LLM4SE and LLM4Security.
TaskPromptingFine-tuningRAGAgent-based
Code Generation (function)∙\bullet∘\circ∘\circ–
Code Generation (repo-level)∘\circ–∙\bullet∙\bullet
Automated Program Repair∘\circ∙\bullet∘\circ∘\circ
Test Generation∙\bullet∘\circ∘\circ∘\circ
Code Review∙\bullet∘\circ∘\circ–
Vulnerability Detection∘\circ∙\bullet∙\bullet–
Table 6: LLM adaptation strategies and their applicability across SE and security tasks. ∙\bullet = primary strategy; ∘\circ = commonly used; – = rarely applied.
More in this topic

LLM Evaluation

Large language model evaluation measures what models can do, how reliably they do it, and whether benchmark scores predict real-world performance.

See all 2,408 papers

Explore similar work

CardsList
May 26, 2026

SEC-bench Pro: Can Language Models Solve Long-Horizon Software Security Tasks?

Large language models (LLMs) now support automated software security tasks, including vulnerability discovery and proof-of-concept (PoC) generation. Existing benchmarks do not faithfully evaluate LLMs in real-world bug hunting scenarios because they rely on fuzzing harnesses, target-specific descriptions, or vulnerability-reproduction tasks. We present SEC-bench Pro, a benchmark for measuring agent bug hunting on critical, high-complexity software systems. This work discloses reports with concrete PoC inputs and links fixes into reproducible tasks through a three-phase pipeline for vulnerability collection, environment reconstruction, and oracle-based validation. We instantiate SEC-bench Pro with 183 validated vulnerabilities across V8 and SpiderMonkey, including a V8 subset with more than $1.5 million in cumulative Google Vulnerability Reward Program awards. These instances span memory-safety, sandbox, JIT, and race-condition bugs under browser-grade and runtime-grade execution conditions. Our evaluation shows that coding agents with frontier models remain below 40% success on both evaluated engines. The open-weight Kimi-K2.6 baseline reaches 11.7% on V8, while the strongest frontier configuration reaches 32.0% on V8 and 38.8% on SpiderMonkey. ClaudeCode and Codex solve complementary instance sets, and their two-agent union reaches 37.9% on V8 and 48.8% on SpiderMonkey. SEC-bench Pro provides robust environments for assessing LLM-based security agents and exposes limitations in long-horizon bug hunting tasks.

Hwiwon Lee, Jiawei Liu, Dongjun Kim +3

University of Illinois Urbana-Champaign

Software Vulnerability DetectionSoftware SecurityLLM Agent SecurityAI Agent Security Benchmarks
AskPDF
Aug 28, 2026

LLM-Based Agents for Software and Systems Security: Approaches, Applications, and Assessment

Software and systems security workflows are typically procedural: analysts inspect heterogeneous artifacts, form hypotheses, invoke tools, interpret outputs, and revise plans. Large language model (LLM)-based agents, which can plan, use tools, retain state, and revise actions across multi-step workflows, are being rapidly adopted to automate this work. Given the consequences of delegating security decisions to autonomous systems, understanding how such agents are built, used, and assessed is crucial. Yet to this date, there remains a lack of systematic understanding of what has been done and how far we are in this field: the term "agent" is applied inconsistently, applications differ sharply in risk, and assessment protocols are often incomparable. To gain a comprehensive and coherent view of this area hence inform relevant future research, this paper provides a systematic literature review of the (1) technical approaches, including agent architecture, perception, memory, reasoning and planning, action space, orchestration, and self-improvement, (2) applications, with respect to the security tasks served, and (3) assessment, including the datasets, outcome and trajectory metrics, safety measures, and baselines considered, over the peer-reviewed literature spanning the emergence of this area (2023--2026). Our synthesis reveals a field that has built agents able to act but not yet agents whose authority is bounded or whose behavior is auditable. In addition to knowledge systematization, we also extend our insights into the limitations of and challenges faced by current approach, application, and assessment designs, which shed light on potentially promising future research directions.

Jingjing Nie, Jiawei Guo, Krishna Meda +1

University at Buffalo, SUNY, Buffalo, New York, USA

LLM Agent SecurityLLMs for CybersecurityLLM Agent Evaluation
AskPDF
Mar 11, 2026

TOSSS: a CVE-based Software Security Benchmark for Large Language Models

With their increasing capabilities, Large Language Models (LLMs) are now used across many industries. They have become useful tools for software engineers and support a wide range of development tasks. As LLMs are increasingly used in software development workflows, a critical question arises: are LLMs good at software security? At the same time, organizations worldwide invest heavily in cybersecurity to reduce exposure to disruptive attacks. The integration of LLMs into software engineering workflows may introduce new vulnerabilities and weaken existing security efforts. We introduce TOSSS (Two-Option Secure Snippet Selection), a benchmark that measures the ability of LLMs to choose between secure and vulnerable code snippets. Existing security benchmarks for LLMs cover only a limited range of vulnerabilities. In contrast, TOSSS relies on the CVE database and provides an extensible framework that can integrate newly disclosed vulnerabilities over time. Our benchmark gives each model a security score between 0 and 1 based on its behavior; a score of 1 indicates that the model always selects the secure snippet, while a score of 0 indicates that it always selects the vulnerable one. We evaluate 14 widely used open-source and closed-source models on C/C++ and Java code and observe scores ranging from 0.48 to 0.89. LLM providers already publish many benchmark scores for their models, and TOSSS could become a complementary security-focused score to include in these reports.

Marc Damie, Murat Bilgehan Ertan, Domenico Essoussi +3

Modat, The Hague, The Netherlands

LLM Safety BenchmarksSoftware SecurityLLM SecuritySoftware Vulnerability Detection
AskPDF