A firehose of papers on LLMs hunting software bugs
Someone had to catalog the flood of research turning LLMs into security auditors.

What it does
This repository is a community-maintained awesome-list that corrals research papers, benchmarks, and open-source tools applying Large Language Models to software vulnerability detection. The README is built around a sprawling markdown table spanning function-level analysis, repository-level scans, smart-contract audits, and agentic approaches, with direct links to papers and their corresponding code when available. It functions as a living map for a research niche that is proliferating faster than most bibliographic databases can track.
The interesting bit
The list exposes the field’s current obsessions—RAG-augmented detection, neuro-symbolic rule synthesis, and agentic false-positive filtering—without forcing you to read dozens of abstracts. It also quietly highlights the reproducibility gap: many 2026 preprints already have GitHub repos, while some peer-reviewed papers offer no code at all.
Key highlights
- Curated coverage of function-level, repository-level, agentic, and smart-contract vulnerability detection, plus datasets and benchmarks.
- Direct links to both academic papers (arXiv, DOI, or anthology) and associated GitHub repositories, where available.
- Includes meta-research such as systematic literature reviews, empirical comparisons to traditional static analysis, and reproducibility critiques.
- Tracks specialized niches like smart-contract auditing, embedded-system taint analysis, and neuro-symbolic rule synthesis.
- Actively updated with 2025 and 2026 preprints alongside established conference publications (NDSS, ICSE, ACL, Usenix).
Caveats
- Many entries have empty cells—some 2026 preprints lack paper links, while several peer-reviewed papers have no associated repository.
- Discovery is README-only, so finding specific techniques relies on browser search rather than structured filtering.
- No explicit inclusion criteria or review rubric is outlined in the visible portion of the README.
Verdict
If you are a security researcher, graduate student, or tool-builder trying to map the LLM vulnerability-detection landscape, this list will save you hours of literature search. If you are looking for a single tool to plug into your CI pipeline, look elsewhere—this is a reading list, not a framework.
Frequently asked
- What is huhusmang/Awesome-LLMs-for-Vulnerability-Detection?
- Someone had to catalog the flood of research turning LLMs into security auditors.
- Is Awesome-LLMs-for-Vulnerability-Detection open source?
- Yes — huhusmang/Awesome-LLMs-for-Vulnerability-Detection is open source, released under the MIT license.
- What language is Awesome-LLMs-for-Vulnerability-Detection written in?
- huhusmang/Awesome-LLMs-for-Vulnerability-Detection is primarily written in Python.
- How popular is Awesome-LLMs-for-Vulnerability-Detection?
- huhusmang/Awesome-LLMs-for-Vulnerability-Detection has 1.2k stars on GitHub.
- Where can I find Awesome-LLMs-for-Vulnerability-Detection?
- huhusmang/Awesome-LLMs-for-Vulnerability-Detection is on GitHub at https://github.com/huhusmang/Awesome-LLMs-for-Vulnerability-Detection.