VulnBench
Menu

Release catalog

Versioned evidence, preserved over time

Each VulnBench release defines its own protocol, reference model, metrics, dataset version, and compatibility boundary.

  1. Current release

    Snyk VulnBench 2.0

    What do AI security agents find that SAST does not, and what do they miss that SAST catches?

    A blind study of nine productized security configurations, from the Snyk Code static analyzer to Claude Code, Codex Security and DeepSec, on 108 hand-curated, attacker-reachable vulnerabilities in 20 open-source web applications.

    Release overviewExplore evidenceData and provenance
    Status
    current
    Published
    Dataset
    2.0.0
    Last updated

  2. Superseded release

    Snyk VulnBench JS 1.0

    Can LLMs find the same bugs twice?

    A controlled study of how repeatably agentic LLM security reviews find vulnerabilities in the same JavaScript code, prompt, and benchmark harness.

    Release overviewExplore evidenceData and provenance
    Status
    superseded
    Published
    Dataset
    1.0.0
    Last updated

Each release defines its own protocol, reference set, metrics and dataset version. Numbers are never compared across releases.