x.com/lukOlejnik/status/2053756142409470359?s=20

ZeroPath’s own benchmark materials describe these as patched/benign counterparts, not verified clean functions. The benchmark authors explicitly note that a code sample can contain more than one vulnerability and that, after the fix, “we can't actually say that the benign function is free of flaws.” They also say that when the model found issues on patched functions, “it's hard to say exactly how many are false positives vs other real issues.”

So the numeric part — that the model flagged 38–51% of patched counterparts — is broadly consistent with the benchmark. But calling those functions “clean” is incorrect, because the benchmark did not establish that the post-patch versions were flaw-free. The benchmark measured findings on patched versions of vulnerable functions, not on a validated clean-code set, so this cannot be described as 38–51% of clean functions being flagged.