Summary of Large Language Models for In-File Vulnerability Localization Can Be 'Lost in the End' (FSE2025)

This summary presents the FSE 2025 study on whether off-the-shelf large language models (LLMs) can localize security vulnerabilities when prompted with entire source files. Using 1 588 CVE-derived file pairs across XSS, SQL injection, and path traversal, the authors find modest and uneven detection performance and uncover a consistent long-context failure mode: vulnerabilities near the end of longer files are disproportionately missed ('lost in the end'). A simple line-preserving chunking strategy substantially increases recall, with CWE-specific optimal chunk sizes.