As software development accelerates with the help of AI coding assistants, catching security flaws early has become more critical than ever. A newly published research paper introduces REVA, an AI-powered tool designed to detect software vulnerabilities in real time—helping developers find potential security issues faster and more efficiently. This matters because the later a vulnerability is found, the more expensive and complicated it becomes to fix, posing risks to users and organizations alike.
Key Takeaways
- REVA detects software vulnerabilities with accuracy comparable to the best existing AI tools but is over 250 times faster, delivering results in about one second per function.
- It combines security context, static code analysis, and call-graph information into a single AI model pass, avoiding the slow multi-step reasoning process used by prior approaches.
- REVA uses a trained “probe” to interpret the internal knowledge of large language models (LLMs), making it more accurate than simply asking the AI for a direct vulnerability verdict.
- Tests across multiple open AI models show REVA consistently matches or outperforms state-of-the-art detectors, demonstrating its robustness and general applicability.
Traditional vulnerability detection with AI can be slow because advanced methods mimic human security experts by repeatedly analyzing code, testing hypotheses, and gathering evidence before making a judgment. While effective, this agent-like reasoning takes minutes per function—too long for real-time screening in fast-paced development environments.
Other approaches try to speed things up by fine-tuning AI models or asking them directly if a piece of code is vulnerable. However, these methods often lack important context about the surrounding code and module, reducing their accuracy. REVA addresses this by feeding the AI model a rich snapshot of the code’s security context upfront. This includes a pre-computed threat model of the module, lightweight static analysis results (which examine code structure without running it), and call-graph information that maps how functions interact.
Instead of running multiple reasoning steps, REVA uses a trained probe—a specialized AI component that “reads” the internal data representations generated by the large language model when it processes the function along with its context. These internal representations contain nuanced information about the code that the probe can interpret to quickly and accurately predict vulnerabilities.
In tests on PrimeVul, a benchmark dataset for software vulnerabilities, REVA achieved 60% accuracy on a popular large language model (GLM-5.3-Flash) in about one second per function. This performance matches the accuracy of VulTriage, a state-of-the-art agentic detector that takes minutes per function, while being dramatically faster and cheaper to run. The probe’s predictions were also 14% to 17% more accurate than the AI’s own direct vulnerability verdicts, showing the value of interpreting the model’s internal signals rather than relying on its immediate output.
REVA’s approach was similarly effective across three different open-source large language models, often outperforming VulTriage by around 10%. This suggests that the internal “knowledge” embedded in LLMs can be harnessed efficiently without the need for slow, multi-step reasoning processes.
Looking ahead, tools like REVA could become an essential first line of defense in software development pipelines, providing fast and reliable vulnerability screening as new code is written or generated by AI assistants. This would help developers catch security issues early, reduce costly fixes later, and improve overall software safety. Further research may explore expanding REVA’s capabilities to more complex codebases and integrating it seamlessly into real-world development environments.
Based on research published on arXiv by Amine Lbath, Massih-Reza Amini.