# Snyk VulnBench JS 1.0: Can LLMs Find the Same Bugs Twice?

DevFeed: [Snyk VulnBench JS 1.0: Can LLMs Find the Same Bugs Twice?](<https://devfeed.tech/articles/snyk-vulnbench-js-1-0-can-llms-find-the-same-bugs-twice-8179.md>)

Original publisher: [Read original article](<https://snyk.io/blog/snyk-vulnbench-js-1-0-llm-security-review-repeatability/>)

Author: Liran Tal

Published: 2026-06-29T00:00:00Z

Content type: article

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [Application Security](<https://devfeed.tech/topics/application-security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [AI-assisted coding](<https://devfeed.tech/topics/ai-assisted-coding.md>)

Tags: [agentic](<https://devfeed.tech/tags/agentic.md>), [ai](<https://devfeed.tech/tags/ai.md>), [application-security](<https://devfeed.tech/tags/application-security.md>), [awareness](<https://devfeed.tech/tags/awareness.md>), [benchmark](<https://devfeed.tech/tags/benchmark.md>), [blog](<https://devfeed.tech/tags/blog.md>), [claude](<https://devfeed.tech/tags/claude.md>), [code-security](<https://devfeed.tech/tags/code-security.md>), [developer](<https://devfeed.tech/tags/developer.md>), [devops](<https://devfeed.tech/tags/devops.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [interest](<https://devfeed.tech/tags/interest.md>), [llms](<https://devfeed.tech/tags/llms.md>), [node-js](<https://devfeed.tech/tags/node-js.md>), [security](<https://devfeed.tech/tags/security.md>), [snyk-code](<https://devfeed.tech/tags/snyk-code.md>), [snyk-open-source](<https://devfeed.tech/tags/snyk-open-source.md>), [snyk-platform](<https://devfeed.tech/tags/snyk-platform.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [vulnerability-insights](<https://devfeed.tech/tags/vulnerability-insights.md>)

## AI overview

Snyk VulnBench JS 1.0 evaluates how consistently agentic LLM security reviews find vulnerabilities across identical repeated scans. Reference-matched findings were comparatively stable, while LLM-only reports varied substantially; the article argues for combining LLM review with deterministic SAST rather than replacing either approach.

## Source excerpt

Snyk VulnBench JS 1.0: 300 repeated scans show LLM security findings vary by run, while SAST and models catch different vulnerability gaps.