CodeRabbit blocks malicious PRs but names the target vulnerability 16 of 31 times, and 0 of 7 when evidence sits outside touched files.

MalPR-Bench covers 89 malicious pull requests plus 50 benign controls across 44 repositories and eight language families, each with a pre-committed rubric giving no credit for off-target findings (arXiv 2608.25730). The authors name the Verdict-Diagnosis gap: a reviewer can block a PR for an unrelated issue, and fixing what it reported leaves the real defect exploitable. On 31 held-out malicious PRs, PRGuard and CodeRabbit block comparably at 22 and 24, but PRGuard identifies 22 target vulnerabilities to CodeRabbit's 16. On 14 absence-type cases both block 9 while PRGuard identifies 9 targets to CodeRabbit's 3.