Minimal scaffold rediscovers 68% of known CVEs

A minimal scaffold rediscovered 65 of 95 real-world CVEs, or 68%, per arXiv 2607.27030. Those 65 are the ones AISLE's analyzer first found across eight repositories. The scaffold matched them using models running as few as 3 billion active parameters.

HoF-Bench pins each CVE at its vulnerable commit and grades results with a detector-blinded judge. The judge only credits a match on code path, root cause, attack condition, and impact together. Ten models ran the scaffold: five open-weight, sized 21B to 284B total parameters, and five proprietary models at small or flash tiers.

Across 7,600 model-CVE pass records, the paper's authors say the scaffold explains the results, not the model tier.

Where all ten failed

Every CVE that none of the ten models found sits in C infrastructure code. The paper doesn't say why C resists rediscovery more than the rest of the corpus. It also doesn't test whether a frontier model would close that gap.