Repairing Broken Access Control in Web Applications with LLMs

Researchers at the Chinese Academy of Sciences released BAC-Bench, a benchmark of 46 real-world broken access control vulnerabilities across six web applications in Java, PHP, Go and Python, each with a sandbox, exploit check and functional tests. Single-turn LLMs fixed 37.68% on average; two simple scaffolds, one feeding back patch errors and one helping locate code, raised that to 66.03%. The best model reached 75.36%, against 78.99% for the best agent. These figures are the authors' own and unverified, and the small benchmark suggests direction rather than firm rates.