PROBE: Frontier Coding Agents Find Different Bugs Than Maintainers Fix
Organizations: ETH Zurich
Abstract
Proactive bug discovery is an important software-engineering problem. Even though coding agents are already widely deployed in this domain, their capabilities remain understudied. In particular, the challenging task of finding all bugs that human maintainers would repair across an entire repository has not been studied yet. To close this gap, we introduce PROBE, a benchmark consisting of all 2,457 bugs fixed over the course of 18 months across 20 diverse GitHub repositories, together with a method for matching candidate findings to this partial reference set. We evaluate coding agents across frontier models and find they all achieve a recall of below and a precision of less than with respect to the reference set. While stronger models increase recall substantially from to , they do not improve precision. Surprisingly, despite the low precision, LLM and human evaluators still judge of findings valid. Crucially, we find that found bug distributions are similar across agents but differ substantially from those of bugs fixed by maintainers. The practical relevance of bug discovery and the low recall of frontier models make this benchmark a valuable resource for both model users and developers.
Figures & tables
| Stage | Count | |
| Commits | 13,254 | – |
| Bug-Fix Commits | 4,296 | |
| Candidate Bugs | 4,763 | |
| Anchored Candidates | 3,345 | |
| Present Candidates | 2,501 | |
| Deduplicated Bugs | 2,457 |
| Model | Effort | Recall (%) | Precision (%) | F1 (%) | Findings | Cost |
| DeepSeek V4.1 Flash | high | 8.1 | 10.5 | 5,019 | $73 | |
| GLM 5.3 Flash | high | 6,029 | $120 | |||
| GPT-5.4 | medium | 4,204 | $655 | |||
| GPT-5.6 Terra | medium | 3,093 | $224 | |||
| Gemini 3.5 Flash | medium | 3,867 | $493 | |||
| Muse Spark 1.3 | high | 8,372 | $164 |
| Human | Agents | |||||
| Category | % | % | Gap (pp) | Ratio | ||
| Wrong arithmetic or comparison expression | 243 | 9.9 | 916 | 18.5 | 1.86 | |
| Unhandled degenerate value | 222 | 9.1 | 674 | 13.9 | 1.53 | |
| Incorrect regular expression pattern | 47 | 1.9 | 245 | 4.7 | 2.47 | |
| Missing state reset or restoration | 57 | 2.3 | 242 | 4.9 | 2.11 | |
| Wrong data source read | 57 | 2.3 | 224 | 4.5 | 1.91 | |
| Dataset | Model | Method | Recall (%) | Precision (%) | F1 (%) | Findings | Cost |
| Full | Claude Sonnet 5 | Vanilla | 17.4 | 86 | $94 | ||
| Passes | 1,656 | $487 | |||||
| Full harness (ours) | 7.9 | 5.8 | 6.7 | 3,472 | $421 | ||
| GPT-5.6 Luna | Vanilla | 32.3 | 65 | $1 | |||
| Passes | 1,826 | $18 | |||||
| Hound | 1,371 | $129 |
Appendix figures & tables20 assets
Supplementary material from the paper’s appendix.
Appendix
| Repository | Domain | Files | Passes | kLOC | Tests | Commits | Fix com. | Bugs |
| tobymao/sqlglot | SQL parsing | 70 | 16 | 49.9 | 646 | 2,848 | 979 | 512 |
| prefecthq/prefect | Workflow orchestration | 420 | 70 | 119.5 | 11,831 | 3,465 | 910 | 429 |
| py-pdf/pypdf | PDF manipulation | 52 | 14 | 35.7 | 562 | 562 | 190 | 165 |
| kozea/weasyprint | HTML/CSS rendering | 65 | 19 | 30.5 | 3,053 | 315 | 196 | 115 |
| fonttools/fonttools | Font tooling | 308 | 69 | 122.1 | 4,372 | 318 | 108 | 113 |
| networkx/networkx | Graph algorithms | 283 | 44 | 112.5 | 5,646 | 481 | 93 | 84 |
| Field | Description |
| repo | GitHub repository. |
| file | Primary bug location file. |
| line_start/end | Primary bug location line numbers. |
| title | Short bug title. |
| description | What is wrong, its trigger and consequence. |
| severity | Impact, from low to critical . |
| Family | Parameter | Full window | First half |
| Exponential | 0.00112 | 0.00190 | |
| Weibull | 0.926 | 0.933 | |
| 1,264 | 763 | ||
| Lognormal | 15.6 | 15.5 | |
| 3.77 | 3.82 |
| 5 years | 10 years | ||
| Exponential | 5,195 | 7,197 | 13,030 |
| Weibull | 5,326 | 7,471 | 15,089 |
| Lognormal | 5,884 | 9,389 | 747,859 |
| Signal | Inputs | Tokens / model | Score | Threshold |
| line overlap | file , line_start , line_end | line ranges in the same file | Jaccard | 0.02 |
| full-text embedding | title , description , first 1,000 characters of code_snippet | all-MiniLM-L6-v2 | cosine | 0.65 |
| description embedding | title , description | all-MiniLM-L6-v2 | cosine | 0.57 |
| snippet tokens | code_snippet | words a of characters | IDF-weighted Jaccard c | 0.60 |
| identifiers | description , code_snippet | words a of characters | IDF-weighted Jaccard c | 0.10 |
| API calls | code_snippet | called names b | IDF-weighted Jaccard c | 0.22 |
| Model | Effort | Recall (%) | Precision (%) | F1 (%) | Findings | Cost |
| DeepSeek V4.1 Flash | high | 11.7 | 14.0 | 1,172 | $15 | |
| GLM 5.3 Flash | high | 1,428 | $25 | |||
| GPT-5.4 | medium | 942 | $138 | |||
| GPT-5.6 Terra | medium | 761 | $46 | |||
| Gemini 3.5 Flash | medium | 867 | $104 | |||
| Muse Spark 1.3 | high | 1,921 | $35 |
| Repository | Bugs | DeepSeek V4.1 Flash (high) | GLM 5.3 Flash (high) | GPT-5.4 (medium) | GPT-5.6 Terra (medium) | Gemini 3.5 Flash (medium) | Muse Spark 1.3 (high, 5 runs) | Claude Sonnet 5 (medium) | GPT-5.6 Sol (high) | GPT-5.6 Sol (medium) | GPT-5.6 Sol (low) | GPT-5.6 Luna (xhigh) | GPT-5.6 Luna (high) | GPT-5.6 Luna (medium, 10 runs) | GPT-5.6 Luna (low) | Claude Opus 5 (medium) | Mean |
| sqlglot | 512 | 8.2 | – | 3.0 | |||||||||||||
| prefect | 429 | 17.9 | – | 11.3 | |||||||||||||
| pypdf | 165 | 30.9 | 16.5 | ||||||||||||||
| weasyprint | 115 | 16.5 | 8.5 | ||||||||||||||
| fonttools | 113 | 31.9 | – | 22.7 | |||||||||||||
| networkx | 84 | 35.7 | 23.4 |
| Repository | DeepSeek V4.1 Flash (high) | GLM 5.3 Flash (high) | GPT-5.4 (medium) | GPT-5.6 Terra (medium) | Gemini 3.5 Flash (medium) | Muse Spark 1.3 (high, 5 runs) | Claude Sonnet 5 (medium) | GPT-5.6 Sol (high) | GPT-5.6 Sol (medium) | GPT-5.6 Sol (low) | GPT-5.6 Luna (xhigh) | GPT-5.6 Luna (high) | GPT-5.6 Luna (medium, 10 runs) | GPT-5.6 Luna (low) | Claude Opus 5 (medium) | Mean |
| sqlglot | 15.3 | – | 10.6 | |||||||||||||
| prefect | 10.3 | – | 8.8 | |||||||||||||
| pypdf | 34.7 | 22.9 | ||||||||||||||
| weasyprint | 8.7 | 6.1 | ||||||||||||||
| fonttools | 7.8 | – | 5.8 | |||||||||||||
| networkx | 6.9 | 5.3 |
| Model | Effort | Confirmed | Rejected | Abstained | Validity (%) | 95% CI |
| GPT-5.4 | medium | 94 | 5 | 1 | 95 | [89, 98] |
| GPT-5.6 Sol | medium | 92 | 5 | 3 | 95 | [88, 98] |
| DeepSeek V4.1 Flash | high | 93 | 6 | 1 | 94 | [87, 98] |
| GPT-5.6 Terra | medium | 89 | 7 | 4 | 93 | [86, 97] |
| GPT-5.6 Luna | medium | 85 | 10 | 5 | 89 | [81, 95] |
| GLM 5.3 Flash | high | 84 | 10 | 6 | 89 | [81, 95] |
| Panel | ||||
| Author | Confirmed | Rejected | Abstained | Total |
| Confirmed | 103 | 0 | 0 | 103 |
| Rejected | 9 | 19 | 6 | 34 |
| Unsure | 35 | 5 | 3 | 43 |
| Total | 147 | 24 | 9 | 180 |
| Model | Effort | Run | Matched | |||
| DeepSeek V4.1 Flash | high | 373 | 0.076 | 0.008 | 0.204 | |
| GLM 5.3 Flash | high | 388 | 0.042 | 0.329 | 1.000 | |
| GPT-5.4 | medium | 270 | 0.039 | 0.692 | 1.000 | |
| GPT-5.6 Terra | medium | 223 | 0.044 | 0.677 | 1.000 | |
| Gemini 3.5 Flash | medium | 240 | 0.067 | 0.157 | 1.000 | |
| Muse Spark 1.3 | high | 1 | 387 | 0.044 | 0.282 | 1.000 |
| Model | Knowledge cut-off | Source |
| Gemini 3.5 Flash | January 2025 | Google (2026) |
| GPT-5.4 | 31 August 2025 | OpenAI (2026b) |
| Claude Sonnet 5 | January 2026 | Anthropic (2026b) |
| GPT-5.6 Luna, Terra, Sol | 16 February 2026 | OpenAI (2026c) ; OpenAI (2026d) ; OpenAI (2026e) |
| Claude Opus 5 | May 2026 | Anthropic (2026a) |
| GLM 5.3 Flash | not published (released 26 August 2026) | Z.ai (2026) |
| Category | Definition |
| Missing case coverage | |
| Missing branch for a supported input variant | Inline conditional logic handles some supported kinds, syntaxes or shapes of input but omits another equally supported variant, so it is processed by the wrong path. |
| Missing rejection of invalid input | Malformed, out-of-range, duplicated or otherwise unsupported input is silently accepted and processed instead of being validated and refused at the boundary. |
| Unhandled degenerate value | Code fails to special case a boundary value that is legal input, such as an empty collection, zero, a single element, or an absent or null field, and then indexes, divides or dereferences it. |
| Unimplemented advertised feature | A documented option, method, mode or format is exposed but its behaviour is absent or a stub, so the request is silently ignored or handled by an unrelated path. |
| Missing dispatch or lookup table entry | A registry, mapping, keyword list, transform table or alias set lacks an entry for a supported case, so lookup falls through to a generic or absent handler. |
| Category | Definition |
| State, shared data and lifecycle | |
| Missing state reset or restoration | Flags, counters, cursors, module globals or cached bookkeeping are left over from a previous operation or are not restored when an operation exits, including exceptional exits without a finally. |
| Colliding key construction | A keyed store is built unsafely, either because the identifier used for caching, indexing, deduplication or grouping lacks a delimiter or a distinguishing component so distinct items collide, or because a plain object or inherited property lookup is used as the container so keys such as proto or constructor corrupt or leak results. |
| Mutation of shared input data | Code mutates data that others alias, either by modifying an argument, option object, cached entry or otherwise shared structure instead of copying it, or by modifying or re-consuming a live view or single pass iterator while it is being traversed, so unrelated callers see changed data or items are skipped, duplicated or lost. |
| Missing cache invalidation | A change to underlying inputs is not propagated to dependents, either because a memoised or cached value is never invalidated or because a dependency, subscription or change notification needed by an observer, effect or rendering pipeline is never registered or emitted, so later reads observe stale data. |
| Missing resource release | Listeners, subscriptions, timers, buffers, sockets, processes or graphics objects are created but never unregistered, cancelled, closed or deleted, so they accumulate or fire after teardown. |
| Human | Agents | ||||||
| Category | % | % | Range | Gap (pp) | Ratio | ||
| Wrong arithmetic or comparison expression | 243 | 9.9 | 916 | 18.5 | 16.9–20.8 | 1.86 | |
| Unhandled degenerate value | 222 | 9.1 | 674 | 13.9 | 10.7–19.6 | 1.53 | |
| Incorrect regular expression pattern | 47 | 1.9 | 245 | 4.7 | 3.1–5.7 | 2.47 | |
| Missing state reset or restoration | 57 | 2.3 | 242 | 4.9 | 3.5–5.9 | 2.11 | |
| Wrong data source read | 57 | 2.3 | 224 | 4.5 | 3.3–5.8 | 1.91 | |
| Human | Agents | ||||
| Level | Needed to observe the failure | % | % | Range | |
| Ordinary use | Any execution of the affected path with common inputs fails or gives a wrong result. | 105 | 4.3 | 6.1 | 4.6–7.8 |
| A specific input | A particular value, shape or edge case is needed, such as an empty or absent value, an unusual variant, malformed data or a boundary. | 1,815 | 74.3 | 83.9 | 79.2–86.3 |
| A specific environment | A particular platform, runtime or dependency version, locale, toolchain or type checker is needed. | 265 | 10.8 | 4.7 | 3.7–6.3 |
| Interaction or inspection | The failure shows only in rendered output, a user interface or a document, or through a user’s sequence of actions, and a person has to look at it. | 92 | 3.8 | 0.7 | 0.3–1.0 |
| Timing, concurrency or load | Concurrent execution, a particular ordering of asynchronous events, a long-running process or large inputs are needed. | 167 | 6.8 | 4.6 | 3.2–6.3 |
| Model | df | ||||
| Muse Spark 1.3, high: 5 runs, 15,233 distinct findings | |||||
| Binomial | 1 | 22,197.0 | 3 | 1.207 | |
| Beta-binomial | 2 | 318.0 | 2 | 0.144 | |
| Stable-beta process | 2 | 2.1 | 2 | 0.357 | 0.012 |
| GPT-5.6 Luna, medium: 10 runs, 7,472 distinct findings | |||||
| Binomial | 1 | 8 | 14.908 | ||
| Model | Parameters | Pool size |
| Muse Spark 1.3, high: 5 runs, 15,233 distinct findings | ||
| Binomial | 15,761 | |
| Beta-binomial | — | |
| Stable-beta process | ||
| GPT-5.6 Luna, medium: 10 runs, 7,472 distinct findings | ||
| Binomial | 7,577 | |
AI Coding Agents
AI coding agents use language models and software tools to plan, edit, test, and maintain code with varying levels of autonomy.
See all 329 papers