Go SAST triage agent cuts scanner noise, but still needs humans
coldyx · reddit · 2026-07-27
A Go-based SAST triage agent uses only two read-only tools — readfile and greprepo — to inspect SARIF findings and decide whether each issue is exploitable, benign, or needs human review.
Setup
- Tested on OWASP BenchmarkJava, with published ground truth.
- Compared three models: Claude Sonnet, DeepSeek-V4-Pro, and Kimi k3.
- The agent does not write or fix code; it only triages findings.
Results
- DeepSeek-V4-Pro: 37 exploitable, 15 benign, 9 uncertain. It caught all 37 real vulnerabilities, but wrongly suppressed 3 real ones.
- Kimi k3: 49 exploitable, 12 benign, 0 uncertain. Fast and cheap, with no uncertain cases in this subset.
- Claude Sonnet 5: 47 exploitable, 9 benign, 5 uncertain. It caught 45 real issues, missed 2, and had 5 cases left for humans.
Takeaway
The author argues the agent is useful for noise reduction, but not a replacement for human review. It can also create PRs with findings after triage, and supports caching to reduce repeat-run cost.
More from coding & agent
- Hands-on walkthrough shows how AI agents are automating SDLC in 2026 — Pavan_Belagatti · 2026-07-27
- Why Retrieval, Reasoning, and Execution Must Remain Separate AI Layers — Harshit-24 · 2026-07-27
- Watching 10 RPA bots run on Xiaohongshu feels like hearing a baby cry — huangyun_122 · 2026-07-27
- Claude Sonnet SEO workflow hits context bloat on multi-domain SERP JSON — MaTT_fromIT · 2026-07-27
- Builder shares a 17k-memory Claude harness with Postgres retrieval and nightly judging — supermegasaurusrex · 2026-07-27
- Claude Opus 5 peaks at medium effort on FrontierCode, while max can hurt coding quality — 量子位 · 2026-07-27