CheckerBench: Can Long-Horizon Agents Synthesize Static-Analysis Checkers?

Hang He, Li Wang, Hao Chen, Yuchen Shao, Yuling Shi, Lisheng Wang, Peiyang Liu, Goose Lin and 4 others

East China Normal University · Humanlaya Data · Shanghai Jiao Tong University · Peking University · Shanghai Innovation Institute

Published October 6, 2026 · on the feed October 7, 2026 · ▲ 61 · arXiv 2610.07557

The abstract

Static-analysis checker synthesis requires agents to interpret a defect specification, inspect a repository, implement analyzer-specific logic, and refine the checker through repeated compilation and analysis feedback. Existing coding-agent benchmarks focus on tasks such as patch generation or vulnerability detection and rarely assess whether an agent can develop a working checker in a repository from start to finish. We introduce CheckerBench, an executable benchmark of 300 tasks derived from 297 CVEs across 167 repositories, 85 CWEs, and five language ecosystems. Each task includes vulnerable and fixed revisions, a pinned analysis environment, and a checker scaffold. We further introduce CheckerLab, a common evaluation framework that independently rebuilds submitted checkers and measures vulnerable-fixed diagnostic contrast, patch localization, false positives, and tool use. Across 21 model-harness configurations and three independent repeats per configuration, mean Pass@1 is 32.30%, while the best reaches 45.33%. These results show that reliable, reusable checker development remains challenging for current coding agents.

The Brief

1:54

A short podcast summary of the paper. Written and voiced by AI.

Transcript

CheckerBench. Can Long-Horizon Agents Synthesize Static-Analysis Checkers?. By Hang He and eleven others, from East China Normal University, Humanlaya Data, and three other institutions. Published on the sixth of October. Its code repository is public and real: about one hundred and sixty source files.

Writing a static-analysis checker is a long job. An agent has to interpret a specification of a defect, inspect a repository, implement logic specific to the analyzer, and then refine the checker over and over through compilation and analysis feedback. Existing benchmarks for coding agents look at tasks like patch generation or vulnerability detection. They rarely test whether an agent can develop a working checker inside a repository from start to finish.

CheckerBench is an executable benchmark of three hundred tasks. Alongside it comes CheckerLab, a common evaluation framework. CheckerLab rebuilds every submitted checker independently, then measures the contrast between diagnostics on vulnerable and fixed code, how well the checker localises the patch, its false positives, and how the agent used its tools.

The tasks are derived from two hundred and ninety-seven CVEs. They span one hundred and sixty-seven repositories, eighty-five CWEs, and five language ecosystems. Each task ships with a vulnerable revision and a fixed revision, a pinned analysis environment, and a scaffold for the checker. The pairing of revisions is what gives the measurement teeth: a checker has to fire on the vulnerable code and not on the fix.

Twenty-one combinations of model and harness were evaluated, each repeated three times independently. Mean Pass at one is thirty-two point three percent. The best configuration reaches forty-five point three three percent.

Even the strongest setup fails on more than half the tasks. By the authors' reading, developing checkers that are reliable and reusable remains a challenge for current coding agents, and this benchmark gives that challenge a fixed, repeatable form.

More with an account

Listen to every day’s papers

Daily playlists, deep dives, quests for the papers, and quizzes on their key terms.

Join free
KipQuest: the day’s AI research, as podcasts and quests. All papers Android app Privacy Contact Episodes are written and voiced by AI from each paper. Summaries can contain mistakes: the paper is the source.