SemTaint: Multi-Agent Taint Specification Extraction for Vulnerability Detection

The multi-agent system SemTaint combines LLMs with static program analysis to extract taint specifications for JavaScript; after integration with CodeQL, it detected 106 of 162 vulnerabilities that the tool previously could not detect. It first uses static analysis to compute a call graph, then has the LLM resolve call edges that static analysis cannot resolve and classify sources/sinks according to a given CWE category, and the resulting specifications are handed to a SAST tool for vulnerability analysis. The system also found 4 new vulnerabilities in 4 popular npm packages, which the authors say shows that LLMs can concretely enhance existing static analysis.