RL for C/C++ vulnerability detection: 21 studies reviewed, key gap found
Only 3 out of 21 RL studies directly detect vulnerabilities in C/C++ code.
A new systematic review from researchers at CIARP 2026 examines how reinforcement learning (RL) is being applied to vulnerability analysis in C/C++ software. Following PRISMA 2020 guidelines, the team identified 21 primary studies published between 2015 and 2026 from major databases. The analysis covers tasks, algorithms, state-action-reward formulations, code representations, datasets, and evaluation metrics. The results reveal a clear skew: 15 of the 21 studies focus on fuzzing and guided exploration, while only 3 tackle direct vulnerability detection and a mere 1 addresses statement-level localization.
The review also flags a critical technical gap. Statically extracted structural representations such as Control Flow Graphs (CFGs) and Abstract Syntax Trees (ASTs) are rarely used as agent states in RL for vulnerability analysis. Current benchmarks lack comparability, making it hard to evaluate progress. The researchers propose a task-oriented taxonomy and highlight the absence of RL agents that use source-code CFGs as states to detect and localize vulnerable nodes. For security engineers and AI researchers, this review maps a sparse landscape and points to a clear, underexplored opportunity for advancing automated C/C++ security analysis.
- Only 3 of 21 RL studies directly detect vulnerabilities; 15 focus on fuzzing and guided exploration.
- Statically extracted CFGs and ASTs are rarely used as RL agent states despite their potential.
- Researchers propose a new taxonomy and identify a gap: no RL agent uses source-code CFGs for node-level vulnerability localization.
Why It Matters
Maps underexplored RL approaches that could drastically improve automated C/C++ security analysis.