[
  {
    "slug": "false-positive-rate",
    "term": "False positive rate",
    "definition": "The share of reported findings that are not real, exploitable bugs. Benchmarks that count only recall against a curated bug list cannot measure it.",
    "detail": [
      "Nethermind made the point about EVMbench: a tool can score well on recall while burying users in invalid findings. zkSecurity's HumanityLink engagement showed a threat-model file cutting false positives from 14 of 33 findings to 2, which is why the checklist asks whether scope input measurably reduces noise."
    ],
    "page": "https://agentsast.com/glossary/false-positive-rate/"
  },
  {
    "slug": "precision-vs-recall",
    "term": "Precision vs recall",
    "tools": [
      "sherlock-ai",
      "auditagent"
    ],
    "definition": "Precision is valid findings divided by all findings reported; recall is known bugs found divided by all known bugs. A useful evaluation reports both.",
    "detail": [
      "Sherlock AI's controlled study reports 55 percent precision; Nethermind reports 30 percent average recall on real audits. Neither number alone tells you whether a tool is worth running; together they tell you how much triage a given amount of coverage costs."
    ],
    "page": "https://agentsast.com/glossary/precision-vs-recall/"
  },
  {
    "slug": "agentic-scanning",
    "term": "Agentic scanning",
    "tools": [
      "zkao",
      "claude-security",
      "codex-security"
    ],
    "definition": "An LLM that plans, reads files, runs tools and tests, and iterates over a codebase, instead of answering one prompt over pasted code.",
    "detail": [
      "Every serious tool on this index is agentic. The differences are in the harness: which tools the agent can run, whether a second wave of agents validates candidates, whether execution provides ground truth, and how much domain knowledge is encoded as skills."
    ],
    "page": "https://agentsast.com/glossary/agentic-scanning/"
  },
  {
    "slug": "llm-plus-fuzzing",
    "term": "LLM plus fuzzing",
    "tools": [
      "buttercup",
      "zkcraft",
      "atlantis"
    ],
    "definition": "The model proposes harnesses, seeds or mutation patterns; the fuzzer supplies ground truth by crashing or violating an oracle.",
    "detail": [
      "This is the AIxCC architecture and the zkCraft design. Its strength is that reported bugs are real by construction; its weakness is that it only reaches what the fuzzer can execute."
    ],
    "page": "https://agentsast.com/glossary/llm-plus-fuzzing/"
  },
  {
    "slug": "llm-plus-formal-verification",
    "term": "LLM plus symbolic execution or formal verification",
    "tools": [
      "certora-ai-composer",
      "olympix",
      "gptscan-propertygpt"
    ],
    "definition": "The model generates properties, invariants or code; a solver or prover checks them, so the model's output is accepted only when a machine confirms it.",
    "detail": [
      "PropertyGPT, Certora AI Composer and Olympix use this pattern for contracts. In ZK, the same idea underlies better.codes and Clean, where the Lean kernel judges AI-written proofs."
    ],
    "page": "https://agentsast.com/glossary/llm-plus-formal-verification/"
  },
  {
    "slug": "hallucinated-vulnerabilities",
    "term": "Hallucinated vulnerabilities",
    "definition": "Confident, plausible findings that do not reproduce. The curl project ended its bug bounty on 31 January 2026 after confirmed-report rates fell below five percent.",
    "detail": [
      "Hallucinated findings are the cost side of AI auditing. The mitigations that work are execution-based validation (sandboxed exploits, fuzzing oracles), a second validating agent, and a human who reproduces before reporting."
    ],
    "page": "https://agentsast.com/glossary/hallucinated-vulnerabilities/"
  },
  {
    "slug": "triage-burden",
    "term": "Triage burden",
    "tools": [
      "zkao",
      "codex-security"
    ],
    "definition": "The human time needed to validate candidate findings. zkSecurity reported more than a thousand candidates across two hundred projects as its main bottleneck; Codex Security reported more than ten thousand high findings in its first month.",
    "detail": [
      "Triage is where AI auditing budgets actually go. Tools that deduplicate across runs, rank by confidence and ship proofs of concept reduce it; tools that maximise finding counts increase it."
    ],
    "page": "https://agentsast.com/glossary/triage-burden/"
  },
  {
    "slug": "benchmark-contamination",
    "term": "Benchmark contamination",
    "tools": [
      "evmbench",
      "zkbugs"
    ],
    "definition": "The model has seen the audit report or the bug in training, so a benchmark hit measures recall of memory rather than discovery.",
    "detail": [
      "OpenZeppelin raised this about EVMbench; it applies to every benchmark built from public audits, including zkbugs. The defences are benchmarks that post-date model cutoffs, private held-out sets, and full-codebase modes that test search rather than recognition."
    ],
    "page": "https://agentsast.com/glossary/benchmark-contamination/"
  },
  {
    "slug": "human-in-the-loop",
    "term": "Human-in-the-loop",
    "definition": "A named person validates exploitability, severity and disclosure before a finding is reported to a client or maintainer.",
    "detail": [
      "Every firm on this index states it. The CIRCL study shows why: the AI rated four of seven severities too high and one critical too low. The person who signs the report is accountable for those calls."
    ],
    "page": "https://agentsast.com/glossary/human-in-the-loop/"
  },
  {
    "slug": "ai-assisted-vs-ai-audit",
    "term": "AI-assisted audit vs AI audit",
    "definition": "An AI-assisted audit is a human-signed report in which AI widened coverage; an AI audit is machine output with no accountable reviewer.",
    "detail": [
      "The distinction decides what a report is worth to an insurer, an exchange listing team or a grant committee. Ask which one you are buying."
    ],
    "page": "https://agentsast.com/glossary/ai-assisted-vs-ai-audit/"
  },
  {
    "slug": "prompt-injection",
    "term": "Prompt injection in auditing pipelines",
    "definition": "Repository contents (commit messages, comments, PR descriptions, issue text) can carry instructions that hijack an agent running with CI privileges.",
    "detail": [
      "Three injection CVEs were found in a Git MCP server in 2026 and one security vendor recorded a fivefold rise in large injection payloads between March and May 2026. An auditing agent with write access to your repository or secrets is a target; isolate it, scope its credentials, and ask the vendor how repository content is separated from agent instructions."
    ],
    "page": "https://agentsast.com/glossary/prompt-injection/"
  },
  {
    "slug": "responsible-disclosure-ai",
    "term": "Responsible disclosure of AI-found bugs",
    "definition": "The same coordinated-disclosure rules as human findings, plus a duty to send only validated, reproducible reports so maintainers are not flooded.",
    "detail": [
      "The curl bounty shutdown is the consequence of ignoring the second half. zkSecurity's CIRCL and Bron Labs disclosures, with minimised proofs of concept and bounty coordination, are the model."
    ],
    "page": "https://agentsast.com/glossary/responsible-disclosure-ai/"
  },
  {
    "slug": "continuous-scanning",
    "term": "Continuous scanning and run-count coverage",
    "tools": [
      "zkao",
      "octane",
      "olympix"
    ],
    "definition": "Running AI analysis repeatedly, on every commit and whenever models improve, on the premise that LLM bug finding is non-deterministic and coverage compounds with runs.",
    "detail": [
      "zkao's continuous-security page cites an 8 percent per-run hit rate compounding to 96 percent over forty runs; its later Bron Labs post adds that under fixed models and prompts runs converge, so the harness matters more than repetition. Both statements are true and together they justify continuous scanning with evolving harnesses."
    ],
    "page": "https://agentsast.com/glossary/continuous-scanning/"
  },
  {
    "slug": "proof-of-concept-harness",
    "term": "Proof-of-concept harness",
    "tools": [
      "zkao",
      "olympix",
      "codex-security"
    ],
    "definition": "Tooling that turns a candidate finding into an executable exploit or failing test, such as zkao's cheatVM for Aleo or Codex Security's sandbox.",
    "detail": [
      "A finding with a runnable PoC costs minutes to validate; one without can cost hours. The HumanityLink engagement found AI-written PoCs unrealistic without such tooling."
    ],
    "page": "https://agentsast.com/glossary/proof-of-concept-harness/"
  },
  {
    "slug": "threat-model-file",
    "term": "Threat model file",
    "tools": [
      "zkao",
      "codex-security"
    ],
    "definition": "A scope document the tool reads before scanning (zkao's zkao.md, Codex Security's generated threat model) stating trust boundaries, adversaries and out-of-scope behaviour.",
    "detail": [
      "It is the single cheapest false-positive reducer on this index. Write it before the first scan."
    ],
    "page": "https://agentsast.com/glossary/threat-model-file/"
  },
  {
    "slug": "severity-calibration",
    "term": "Severity calibration",
    "definition": "Whether the tool's assigned severities match what an expert would assign. In the CIRCL study, four of seven AI severities were too high and one critical was rated medium.",
    "detail": [
      "Mis-calibration in both directions is expected; a human must re-rate. Reports that pass AI severities through unchanged are a red flag."
    ],
    "page": "https://agentsast.com/glossary/severity-calibration/"
  }
]