# Oshando Johnson and coauthors propose code-grounded explanations for vulnerability findings [Canonical reading](https://escapemeridian.com/readings/oshando-johnson-and-coauthors-propose-code-grounded-11da57b9) The authors argue that developers need explanations of static application security testing (SAST) findings without giving a language model control over detection. Their redesigned SAFE plugin leaves detection to the analyser and requires its agent to consult the repository and the rule that fired before explaining a finding. It offers explanations in tiers and ties them to the reported data flow. In a within-subjects crossover experiment with 24 participants, perceived usability rose from 77.3 to 85.0 on the System Usability Scale, and the odds of a correct remediation were 2.6 times higher than with the predecessor. The authors say actionability gained most among explanation-quality items, while triage accuracy and time per finding were indistinguishable; they caution that this was uninformative rather than evidence of equivalence. Trust did not move. The authors interpret closing interviews as indicating that grounding made findings easier to understand, not easier to believe. Participants also wanted the tool to find and explain, while they judge and apply. The results describe this experiment, not evidence of performance in broader use. Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims. ## Original source arXiv cs.AI · Article Original source date: Nov 9, 2026 (2026-11-09). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-11T20:33:16.710Z. First observed: 2026-11-11T05:04:25.205Z. Retrieved: 2026-11-11T20:32:08.739Z. - [Code-Grounded Agentic Explanations for Static Analysis Vulnerability Findings](https://arxiv.org/abs/2611.13041) ## Limits The experiment compared the redesign with its predecessor in a within-subjects crossover involving 24 participants; the evidence does not establish how the results would generalize beyond that experiment. The authors say triage accuracy and time per finding were indistinguishable, and explicitly describe this as uninformative rather than evidence of equivalence. The abstract reports that trust did not move and describes what closing interviews indicate, but does not establish why trust remained unchanged. ## Open question Would the finding that grounding improves understanding but not trust hold beyond the 24-participant experiment? ## Source-stated The authors designed SAFE to explain SAST findings while keeping detection with the analyser; its agent must consult the repository and the rule that fired. > We keep detection with the analyser and give the model only the explaining. - [Supporting source](https://arxiv.org/abs/2611.13041) ## Source-stated The redesigned SAFE offers explanations in tiers, ties them to reported data flow, and requires repository and rule consultation before answering. > It tiers explanations by demand, ties them to the reported data flow, and replaces the single-prompt backend with an agent that must consult the repository and the rule that fired before answering. - [Supporting source](https://arxiv.org/abs/2611.13041) ## Source-stated In a within-subjects crossover experiment with 24 participants, perceived usability rose from 77.3 to 85.0 on the System Usability Scale. > A within-subjects crossover experiment with 24 participants compared the redesign against its predecessor. Perceived usability rose from 77.3 to 85.0 on the System Usability Scale. - [Supporting source](https://arxiv.org/abs/2611.13041) ## Source-stated The authors report that the odds of a correct remediation were 2.6 times higher, while triage accuracy and time per finding were indistinguishable. > the odds of a correct remediation were 2.6 times higher. Triage accuracy and time per finding were indistinguishable, which we read as uninformative rather than as equivalence. - [Supporting source](https://arxiv.org/abs/2611.13041) ## Source-stated Trust did not change; the authors interpret interviews as showing that grounding helped participants understand findings rather than believe them more. > Trust was the one measure that did not move, and the closing interviews indicate that grounding made findings easier to understand rather than easier to believe. - [Supporting source](https://arxiv.org/abs/2611.13041) ## Source-stated Participants drew a boundary in which the tool finds and explains findings while they judge and apply them. > Participants also drew a boundary no requirement anticipated, wanting the tool to find and explain while they judge and apply. - [Supporting source](https://arxiv.org/abs/2611.13041) ## Source and contributor context Johnson, Oshando, Krishnamurthy, Ranjith, Shanmuganathan, Rohith Kumar, Piskachev, Goran, Bodden, Eric · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## TIME TIME is a news magazine publishing reporting on world affairs, business, technology and the workers behind digital services. - [Explore this context](/entities/time) - [Reference](https://time.com/) ## Editorial provenance Version 1. Publication ID: 0b75722c-25b6-4474-8a8e-257350d4ac3f. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-11T20:33:16.710Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: 1fc3431e01101d35e145d5bf08c3e4d8473c439f46c4e0fc36b22b8d1476d223. Source text hash: 9b0a850eb16f1bb2bee943867501d5ef8bc7f1551430e6d9f16840c5eb3e2b50. ## Revision and source-check history ### Version 1 — 2026-11-11T20:33:16.710Z The authors argue that developers need explanations of static application security testing (SAST) findings without giving a language model control over detection. Their redesigned SAFE plugin leaves detection to the analyser and requires its agent to consult the repository and the rule that fired before explaining a finding. It offers explanations in tiers and ties them to the reported data flow. In a within-subjects crossover experiment with 24 participants, perceived usability rose from 77.3 to 85.0 on the System Usability Scale, and the odds of a correct remediation were 2.6 times higher than with the predecessor. The authors say actionability gained most among explanation-quality items, while triage accuracy and time per finding were indistinguishable; they caution that this was uninformative rather than evidence of equivalence. Trust did not move. The authors interpret closing interviews as indicating that grounding made findings easier to understand, not easier to believe. Participants also wanted the tool to find and explain, while they judge and apply. The results describe this experiment, not evidence of performance in broader use. ## Original source arXiv cs.AI · Article Original source date: Nov 9, 2026 (2026-11-09). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-11T20:33:16.710Z. First observed: 2026-11-11T05:04:25.205Z. Retrieved: 2026-11-11T20:32:08.739Z. - [Code-Grounded Agentic Explanations for Static Analysis Vulnerability Findings](https://arxiv.org/abs/2611.13041) ## Limits The experiment compared the redesign with its predecessor in a within-subjects crossover involving 24 participants; the evidence does not establish how the results would generalize beyond that experiment. The authors say triage accuracy and time per finding were indistinguishable, and explicitly describe this as uninformative rather than evidence of equivalence. The abstract reports that trust did not move and describes what closing interviews indicate, but does not establish why trust remained unchanged. ## Open question Would the finding that grounding improves understanding but not trust hold beyond the 24-participant experiment? ## Source-stated The authors designed SAFE to explain SAST findings while keeping detection with the analyser; its agent must consult the repository and the rule that fired. > We keep detection with the analyser and give the model only the explaining. - [Supporting source](https://arxiv.org/abs/2611.13041) ## Source-stated The redesigned SAFE offers explanations in tiers, ties them to reported data flow, and requires repository and rule consultation before answering. > It tiers explanations by demand, ties them to the reported data flow, and replaces the single-prompt backend with an agent that must consult the repository and the rule that fired before answering. - [Supporting source](https://arxiv.org/abs/2611.13041) ## Source-stated In a within-subjects crossover experiment with 24 participants, perceived usability rose from 77.3 to 85.0 on the System Usability Scale. > A within-subjects crossover experiment with 24 participants compared the redesign against its predecessor. Perceived usability rose from 77.3 to 85.0 on the System Usability Scale. - [Supporting source](https://arxiv.org/abs/2611.13041) ## Source-stated The authors report that the odds of a correct remediation were 2.6 times higher, while triage accuracy and time per finding were indistinguishable. > the odds of a correct remediation were 2.6 times higher. Triage accuracy and time per finding were indistinguishable, which we read as uninformative rather than as equivalence. - [Supporting source](https://arxiv.org/abs/2611.13041) ## Source-stated Trust did not change; the authors interpret interviews as showing that grounding helped participants understand findings rather than believe them more. > Trust was the one measure that did not move, and the closing interviews indicate that grounding made findings easier to understand rather than easier to believe. - [Supporting source](https://arxiv.org/abs/2611.13041) ## Source-stated Participants drew a boundary in which the tool finds and explains findings while they judge and apply them. > Participants also drew a boundary no requirement anticipated, wanting the tool to find and explain while they judge and apply. - [Supporting source](https://arxiv.org/abs/2611.13041) ## Source and contributor context Johnson, Oshando, Krishnamurthy, Ranjith, Shanmuganathan, Rohith Kumar, Piskachev, Goran, Bodden, Eric · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## TIME TIME is a news magazine publishing reporting on world affairs, business, technology and the workers behind digital services. - [Explore this context](/entities/time) - [Reference](https://time.com/) ## Editorial provenance Version 1. Publication ID: 0b75722c-25b6-4474-8a8e-257350d4ac3f. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-11T20:33:16.710Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: 1fc3431e01101d35e145d5bf08c3e4d8473c439f46c4e0fc36b22b8d1476d223. Source text hash: 9b0a850eb16f1bb2bee943867501d5ef8bc7f1551430e6d9f16840c5eb3e2b50. ### uncertain — 2026-11-11T20:33:16.710Z — anthropic/claude-opus-5.5 Publication: 0b75722c-25b6-4474-8a8e-257350d4ac3f attribution — pass: The title credits Oshando Johnson and coauthors, matching the listed authors. The summary attributes the arguments, interpretations and results to the authors. The participant boundary is correctly attributed to participants. > Authors:Oshando Johnson, Ranjith Krishnamurthy, Rohith Kumar Shanmuganathan, Goran Piskachev, Eric Bodden summary — uncertain: The summary omits the authors' core rationale: handing detection to the model gives up the auditability that makes static analysis defensible. Without it, a general reader cannot tell why keeping detection with the analyser matters. Repair: add one sentence noting that SAST verdicts are rule-based and auditable, and that the authors want to preserve that. Central terms such as within-subjects crossover, triage, remediation, data flow and grounding are not explained in plain language; tooltips or brief glosses would help. The question is fair and not leading. > designs that also hand the model the detection give up the auditability that makes static analysis defensible date — pass: originalPublished is 2026-11-09, which matches the v1 arXiv submission date. The later feed date is correctly not used. > \[Submitted on 9 Nov 2026\] support — pass: The claims and their excerpts are verbatim-grounded. The usability scores, the 2.6x odds, the indistinguishable triage and time results with the authors' caveat, the unchanged trust measure and the participant boundary are all stated in the abstract. The limitations appropriately avoid generalizing beyond the 24-participant experiment. No unsupported benefits are implied. > Perceived usability rose from 77.3 to 85.0 on the System Usability Scale. media — pass: The selected media is the verified direct arXiv abstract page for this paper, so it is the most direct access to the source. ## Recorded references Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter. No public references recorded here yet. [Reference data (JSON)](/readings/11da57b916ff42d40c6ff603a63e69a90fee096593cb955ca5bcf341f668a3c2/references.json) ## Corrections and challenges [Send a correction or an opposing source](https://escapemeridian.com/corrections/) [JSON record](https://escapemeridian.com/readings/oshando-johnson-and-coauthors-propose-code-grounded-11da57b9.json)