Handing a coding agent false-positive templates doubles its success at writing CodeQL refinements, from 28% to 56-62%

arXiv 2609.04535·medium signalXBlueskyLinkedInCopy link

Running CodeQL's Java security suite over 167 CVE instances from 110 projects and manually reviewing 500 false-positive paths produced a five-category taxonomy dominated by Missed Path Constraint or Sanitization (36.6%), Benign Execution Context (29.4%) and Missing Trust Boundary Modeling (27.6%). Query-level refinements built from the taxonomy removed 81.8% of reviewed false positives and 15.8% of all reported paths while retaining 7 of 8 true positives. The agent-relevant result is the generalization test: given the patterns as templates, two agentic coding tools adapted them to new projects on 56% and 62% of tasks with compile-pass rates above 90%, versus 28% success and 30-36% compile rates unguided.