Who Said CVE? How Vulnerability Identifiers Are Mentioned by Humans, Bots, and Agents in Pull Requests
This paper analyzes the usage patterns of vulnerability identifiers in GitHub pull requests, revealing that while bots generate the majority of mentions through automated dependency updates, human developers and autonomous agents provide fewer but more contextually diverse references to support fixes and discussions.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine a massive, bustling construction site where thousands of people are building software. In this world, when a dangerous crack is found in a wall (a security vulnerability), it gets a unique "Wanted Poster" with a specific ID number, like CVE-2025-12345. These posters help everyone know exactly which crack they are talking about.
This paper is like a detective story that asks: "Who is actually putting these 'Wanted Posters' on the construction site, and how are they using them?"
The researchers looked at a specific type of construction site called GitHub, where code is written and fixed. They focused on the "Pull Requests"—which are like formal requests to fix a problem or add a new brick to the building. They wanted to see if Humans, Bots (automated robots), and AI Agents (smart, autonomous helpers) were the ones mentioning these "Wanted Posters."
Here is what they found, broken down simply:
1. The Robots Are the Most Talkative (But Brief)
The Finding: Bots mentioned these vulnerability IDs about 69% of the time.
The Analogy: Think of bots as the mailroom clerks. They are incredibly efficient and handle the vast majority of the mail. When a bot mentions a "Wanted Poster," it's usually doing its job: "Hey, we updated the lock on this door because the old one was broken. Here is the poster for the broken lock (CVE-123)."
- Where they talk: They almost always stick the poster on the main notice board (the Pull Request description). They rarely chat about it in the hallway (comments) or write it on the bricks themselves (commit messages).
- Why: They are mostly just doing automated check-ups or swapping out old parts for new, safer ones.
2. Humans Are the Deep Divers
The Finding: Humans mentioned these IDs less often overall, but when they did, they were much more detailed.
The Analogy: Humans are the architects and lead engineers. They don't just slap a poster on the wall; they discuss the crack, explain why it happened, and how they fixed it.
- Where they talk: Humans put the posters on the notice board, but they also write them on the blueprints (commit messages) and shout them out in the meeting room (titles and comments).
- Why: They use the IDs to explain complex fixes, argue about safety, or make sure everyone understands the specific danger they are solving.
3. The AI Agents Are the New Kids on the Block
The Finding: Autonomous AI agents (like the new smart helpers) mentioned these IDs very rarely.
The Analogy: These agents are like interns who are still learning the ropes. When they do mention a "Wanted Poster," they act a bit like a mix of the mailroom clerk and the architect. They might be fixing a problem or running a safety check, but they haven't started talking about it as much as the humans or the bots yet.
The Big Picture: Different Jobs, Different Styles
The paper concludes that while everyone is using the same "Wanted Posters," they are using them for different reasons:
- Bots use them as receipts: "I did the job, here is the proof."
- Humans use them as explanations: "Here is why we did the job and what it means."
- Agents are just starting to find their voice in this conversation.
The Takeaway:
Right now, the automated robots are doing the heavy lifting of simply noticing and listing the dangers. But the humans are the ones doing the heavy thinking about how to fix them and why it matters. As AI agents start doing more work, we might need to teach them to talk about these dangers more like the humans do—explaining the "why" and not just the "what."
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.