InfoResearchPreprint
CWE-bench: Refocusing Agentic Security from Exploitation to Defense
- Published
- Record updated
Summary
CWE-bench is a private benchmark of 120 held-out repository audit-and-repair tasks spanning 73 CWE types, eight languages, and all OWASP Top 10 2025 categories. Agents must find unspecified weaknesses and write patches that block the exploit while preserving functionality, checked by a programmatic verifier. The best agents reach 68% pass@1 and 81% pass@4, and difficulty varies more by vulnerability category than by language.