19,325 CVEs compiled into 1,033 detection rules packaged as 172 agent skills, producing runtime evidence for 644 findings

arXiv 2609.05335·medium signalXBlueskyLinkedInCopy link

BUGSTONE-E2E mines verified fixing commits for scan anchors, fix semantics and CVE provenance, organizes them by CWE and language, then runs a funnel: Tree-sitter enumerates call sites matching rule anchors, lightweight heuristics drop benign sites with zero LLM calls, and only survivors reach LLM agents that re-triage, build runtime verifications and generate scope-checked patches validated by two-sided differential tests. From 19,325 high-severity CVEs spanning 2022 to 2026 it derived 2,710 fixing commits, 1,033 rules across 56 CWE families, packaged as 172 skills, and produced runtime evidence for 644 findings across 14 programs. The transferable pattern is the cost funnel: cheap deterministic filters first, expensive models only on the shrinking remainder.