Study Measures Gap Between Static Analysis Passes and Dynamic Failures in Python
A new arXiv paper examines cases where Python code passes static security checks but fails when actually executed, a discrepancy the authors call the static-pass dynamic-fail gap. The work focuses on security-sensitive code as well as code produced by large language models, arguing that static analysis alone is insufficient as a security gate. The authors frame the measurement as a step beyond reliance on static guarantees for evaluating generated software.