VulAgentRL: Agentic RL for Interprocedural Vulnerability Detection

A new framework, VulAgentRL, uses agentic reinforcement learning to detect vulnerabilities that span multiple functions in code. The approach addresses a key limitation of existing learning-based detectors, which classify each function in isolation despite 71.7% of vulnerable functions requiring evidence from outside the function. VulAgentRL employs a Code Property Graph (CPG) that serves dual roles: at inference time, the policy queries the CPG for callers, callees, and dataflow; at training time, the same graph verifies the evidence cited by the policy. Because every CPG node has a persistent integer identifier, verification is exact rather than approximate. The framework is detailed in arXiv paper 2607.26656.