Can Open-Source LLM Agents Replace Static Application Security Testing Tools?

arXiv·medium signal

An empirical assessment pits agentic tools built on three open-source models against Bandit, an established SAST scanner, on precision, recall, and false-positive rate. The conclusion is that today's open-source LLM agents are not yet suitable to replace specialized SAST scanning under realistic conditions. A grounded reality-check against the 'agents will do security scanning' hype.