PYSETYPE Turns an LLM Into a Semantic Type Checker and Finds 15 Zero-Days in Real Python Web Apps, 9 Confirmed by Developers

arXiv 2608.14533·high signalXBlueskyLinkedInCopy link

SETYPE is a type system derived purely from the natural-language meaning of variable and function names, where both inference and checking are done by an LLM — a failed type check flags a candidate vulnerability. The Python prototype PYSETYPE hit 87% detection precision and 88% accuracy on real-world applications and surfaced 15 potential zero-days, nine of which developers confirmed. This is a concrete alternative to pattern-matching SAST: the signal comes from semantic mismatch between what a symbol is named and how it is used, which syntactic rules structurally cannot see.