[
  {
    "term": "False positive rate",
    "slug": "false-positive-rate",
    "definition": "The share of reported findings that are not real, exploitable bugs. Benchmarks that count only recall against a curated bug list cannot measure it.",
    "page": "https://agentsast.com/glossary/false-positive-rate/"
  },
  {
    "term": "Precision vs recall",
    "slug": "precision-vs-recall",
    "definition": "Precision is valid findings divided by all findings reported; recall is known bugs found divided by all known bugs. A useful evaluation reports both.",
    "page": "https://agentsast.com/glossary/precision-vs-recall/"
  },
  {
    "term": "Agentic scanning",
    "slug": "agentic-scanning",
    "definition": "An LLM that plans, reads files, runs tools and tests, and iterates over a codebase, instead of answering one prompt over pasted code.",
    "page": "https://agentsast.com/glossary/agentic-scanning/"
  },
  {
    "term": "LLM plus fuzzing",
    "slug": "llm-plus-fuzzing",
    "definition": "The model proposes harnesses, seeds or mutation patterns; the fuzzer supplies ground truth by crashing or violating an oracle.",
    "page": "https://agentsast.com/glossary/llm-plus-fuzzing/"
  },
  {
    "term": "LLM plus symbolic execution or formal verification",
    "slug": "llm-plus-formal-verification",
    "definition": "The model generates properties, invariants or code; a solver or prover checks them, so the model's output is accepted only when a machine confirms it.",
    "page": "https://agentsast.com/glossary/llm-plus-formal-verification/"
  },
  {
    "term": "Hallucinated vulnerabilities",
    "slug": "hallucinated-vulnerabilities",
    "definition": "Confident, plausible findings that do not reproduce. The curl project ended its bug bounty on 31 January 2026 after confirmed-report rates fell below five percent.",
    "page": "https://agentsast.com/glossary/hallucinated-vulnerabilities/"
  },
  {
    "term": "Triage burden",
    "slug": "triage-burden",
    "definition": "The human time needed to validate candidate findings. zkSecurity reported more than a thousand candidates across two hundred projects as its main bottleneck; Codex Security reported more than ten thousand high findings in its first month.",
    "page": "https://agentsast.com/glossary/triage-burden/"
  },
  {
    "term": "Benchmark contamination",
    "slug": "benchmark-contamination",
    "definition": "The model has seen the audit report or the bug in training, so a benchmark hit measures recall of memory rather than discovery.",
    "page": "https://agentsast.com/glossary/benchmark-contamination/"
  },
  {
    "term": "Human-in-the-loop",
    "slug": "human-in-the-loop",
    "definition": "A named person validates exploitability, severity and disclosure before a finding is reported to a client or maintainer.",
    "page": "https://agentsast.com/glossary/human-in-the-loop/"
  },
  {
    "term": "AI-assisted audit vs AI audit",
    "slug": "ai-assisted-vs-ai-audit",
    "definition": "An AI-assisted audit is a human-signed report in which AI widened coverage; an AI audit is machine output with no accountable reviewer.",
    "page": "https://agentsast.com/glossary/ai-assisted-vs-ai-audit/"
  },
  {
    "term": "Prompt injection in auditing pipelines",
    "slug": "prompt-injection",
    "definition": "Repository contents (commit messages, comments, PR descriptions, issue text) can carry instructions that hijack an agent running with CI privileges.",
    "page": "https://agentsast.com/glossary/prompt-injection/"
  },
  {
    "term": "Responsible disclosure of AI-found bugs",
    "slug": "responsible-disclosure-ai",
    "definition": "The same coordinated-disclosure rules as human findings, plus a duty to send only validated, reproducible reports so maintainers are not flooded.",
    "page": "https://agentsast.com/glossary/responsible-disclosure-ai/"
  },
  {
    "term": "Continuous scanning and run-count coverage",
    "slug": "continuous-scanning",
    "definition": "Running AI analysis repeatedly, on every commit and whenever models improve, on the premise that LLM bug finding is non-deterministic and coverage compounds with runs.",
    "page": "https://agentsast.com/glossary/continuous-scanning/"
  },
  {
    "term": "Proof-of-concept harness",
    "slug": "proof-of-concept-harness",
    "definition": "Tooling that turns a candidate finding into an executable exploit or failing test, such as zkao's cheatVM for Aleo or Codex Security's sandbox.",
    "page": "https://agentsast.com/glossary/proof-of-concept-harness/"
  },
  {
    "term": "Threat model file",
    "slug": "threat-model-file",
    "definition": "A scope document the tool reads before scanning (zkao's zkao.md, Codex Security's generated threat model) stating trust boundaries, adversaries and out-of-scope behaviour.",
    "page": "https://agentsast.com/glossary/threat-model-file/"
  },
  {
    "term": "Severity calibration",
    "slug": "severity-calibration",
    "definition": "Whether the tool's assigned severities match what an expert would assign. In the CIRCL study, four of seven AI severities were too high and one critical was rated medium.",
    "page": "https://agentsast.com/glossary/severity-calibration/"
  }
]