Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-24 · high
It found two new bugs in libpng and zlib, with refined CodeQL queries at 98 percent precision or better in benchmark tests.
Why now: The findings come from a paper posted to arXiv in August 2026, covering both benchmark results and two new real-world bugs.
ARQ closed a CodeQL query issue that had sat open for 27 months, per a paper on arXiv (2608.20637). It also turned up two new bugs in libpng and zlib, two libraries with long histories of security review.
The method skips labeled datasets and hand-written vulnerability templates. ARQ synthesizes test programs whose execution disagrees with what a CodeQL query reports. It feeds that disagreement to an LLM repair loop that rewrites the query. On the Juliet v1.3 and FormAI v2 benchmarks, the refined queries caught up to 119.8% more true positives than the originals. Precision stayed at 98.0% or better.
Juliet and FormAI are synthetic test suites, built to exercise known vulnerability patterns. libpng and zlib are real code that other analysis tools have already gone over for years. Bugs found in code like that carry more weight than a benchmark score. A synthetic suite can reward a query for catching exactly the patterns it was tuned on.
Each link below shares sources, entities, or timing with this story.
CodeQL supports Kotlin / Shared entities / Earlier coverage
Linked by a graph relationship (CodeQL supports Kotlin); both cover CodeQL, LLM; earlier CodeQL coverage from 2026-07-12.
Simon Willison released LLM / Shared entity: LLM / Earlier coverage / Tension
Linked by a graph relationship (Simon Willison released LLM); both cover LLM; earlier LLM coverage from 2026-08-16.
Linked by a graph relationship (Simon Willison released LLM); both cover LLM; earlier LLM coverage from 2026-07-27.
Linked by a graph relationship (Simon Willison released LLM); both cover LLM; earlier LLM coverage from 2026-06-19.
Linked by a graph relationship (Simon Willison released LLM); both cover LLM; earlier LLM coverage from 2026-06-18.
Simon Willison released LLM / Shared entity: LLM / Earlier coverage
Linked by a graph relationship (Simon Willison released LLM); both cover LLM; earlier LLM coverage from 2026-08-21.
Linked by a graph relationship (Simon Willison released LLM); both cover LLM; earlier LLM coverage from 2026-08-17.
Linked by a graph relationship (Simon Willison released LLM); both cover LLM; earlier LLM coverage from 2026-08-12.