Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-07-30 · high
The bugs it missed all cluster in C infrastructure code, not spread evenly across the eight repositories.
Why now: As of July 30, no frontier model has been run through HoF-Bench, leaving the C-code gap untested.
A minimal scaffold rediscovered 65 of 95 real-world CVEs, or 68%, per arXiv 2607.27030. Those 65 are the ones AISLE's analyzer first found across eight repositories. The scaffold matched them using models running as few as 3 billion active parameters.
HoF-Bench pins each CVE at its vulnerable commit and grades results with a detector-blinded judge. The judge only credits a match on code path, root cause, attack condition, and impact together. Ten models ran the scaffold: five open-weight, sized 21B to 284B total parameters, and five proprietary models at small or flash tiers.
Across 7,600 model-CVE pass records, the paper's authors say the scaffold explains the results, not the model tier.
Every CVE that none of the ten models found sits in C infrastructure code. The paper doesn't say why C resists rediscovery more than the rest of the corpus. It also doesn't test whether a frontier model would close that gap.
Each link below shares sources, entities, or timing with this story.
Shared entities / Same source domain / Shared topic / Earlier coverage
Both cover CVE, CVEs; reported by the same outlet (arxiv.org); overlapping topics (code, model).
Shared entities / Shared topic / Earlier coverage / Tension
Both cover CVE, CVEs; overlapping topics (code, cves); earlier CVE coverage from 2026-03-23.
Shared entities / Shared topic / Earlier coverage
Both cover CVE, CVEs; overlapping topics (attack, code, cves); earlier CVE coverage from 2026-03-05.
Both cover CVE, CVEs; overlapping topics (active, attack, cves); earlier CVE coverage from 2026-03-01.
Both cover CVE, CVEs; overlapping topics (attack, code, cves); earlier CVE coverage from 2026-02-27.
Shared entity: CVE / Same source domain / Shared topic / Earlier coverage / Tension
Both cover CVE; reported by the same outlet (arxiv.org); overlapping topics (attack, model).
Shared entity: CVEs / Same source domain / Shared topic / Earlier coverage / Tension
Both cover CVEs; reported by the same outlet (arxiv.org); overlapping topics (attack, cves).
Shared entity: Bench / Same source domain / Shared topic / Earlier coverage / Tension
Both cover Bench; reported by the same outlet (arxiv.org); overlapping topics (frontier, model).