A Hong Kong University of Science and Technology team, including She Dongdong, Zhang Kaikai and Zhang Zihan, has proposed RedHerring, a defense that inserts plausible but unreachable vulnerability paths into source code to divert vulnerability-discovery agents from real flaws. The researchers analyzed 300 discovery trajectories and found that verification consumed 73.8% of total time, while verifying one hypothesis cost about 11.1 times as much as generating one. According to 新智元’s summary of the paper, tests across 33 open-source projects and five models, including Qwen, GLM, DeepSeek and Kimi, found 39%–60% fewer real vulnerabilities after RedHerring was added, with agents spending roughly 30%–50% of their compute on the decoys.