What the study found
The study found that CodeCureAgent, an AI agent using large language models (LLMs), can automatically analyze, classify, and repair static analysis warnings. In the reported evaluation, it produced plausible fixes for 96.8% of warnings and a manual inspection found a correct-fix rate of 86.3%.
Why the authors say this matters
The authors say this matters because static analysis warnings are often tedious for developers to handle manually, and ignored warnings can accumulate and degrade code quality. They suggest CodeCureAgent could be used to clean existing codebases and could be integrated into CI/CD pipelines, which are systems that automatically build, test, and deploy code.
What the researchers tested
The researchers evaluated CodeCureAgent on 1,000 SonarQube warnings from 106 Java projects covering 291 distinct rules. The system used an agentic framework that iteratively invoked tools such as code search and code editing, and it approved patches using a three-step heuristic: build the project, verify the warning disappears without new warnings, and run the test suite.
What worked and what didn't
CodeCureAgent produced plausible fixes for 96.8% of the warnings and outperformed baseline approaches by 29.2% to 34.0% in plausible-fix rate. Manual inspection of 291 cases found an 86.3% correct-fix rate, and the reported LLM cost was about 2.9 cents per warning with about four minutes of end-to-end processing time per warning.
What to keep in mind
The evaluation was limited to SonarQube warnings in Java projects, so the abstract does not show how well the approach works for other languages or analysis tools. The paper also notes that earlier work was limited in ways such as specific rules, lack of multi-file edits, and weak validation, but the abstract does not provide detailed failure cases for CodeCureAgent.
Key points
- CodeCureAgent uses LLM-based agents to analyze, classify, and repair static analysis warnings.
- It can suppress false positives and fix true positives when identified.
- In evaluation on 1,000 SonarQube warnings, it produced plausible fixes for 96.8%.
- Manual inspection of 291 cases found an 86.3% correct-fix rate.
- The reported cost was about 2.9 cents per warning, with about four minutes of processing time.
Disclosure
- Research title:
- CodeCureAgent repairs most static analysis warnings in Java projects
- Authors:
- Pascal Joos, Islem Bouzenia, Michael Pradel
- Institutions:
- Helmholtz Center for Information Security, Helmholtz Center for Information Security, Helmholtz Center for Information Security
- Publication date:
- 2026-06-30
- DOI:
- 10.1145/3808140
- OpenAlex record:
- View
Get the weekly research newsletter
Stay current with scholarly research without reading academic papers — one filtered digest, every Friday.