arXiv AI
Natural Code Transformation Confuses Agents in Vulnerability Analysis
Read the original on arXiv AI →The Flow has not summarised this story yet — read it at arXiv AI.
Related stories
arXiv AI
Jun 18
Code-Augur: Agentic Vulnerability Detection via Specification Inference
arXiv:2606. 18619v1 Announce Type: cross Abstract: The advent of agentic vulnerability detection is already becoming a watershed moment for software security.
arXiv AI
Sep 4
PatchBench: Evaluating AI Agents for Vulnerability Patching
PatchBench introduces a benchmark to evaluate AI agents on realistic vulnerability patching tasks, addressing two key threats to validity: patch memorization and surface-level fixes that merely suppress crashes. The study finds that 25% of agent patches resemble historical developer patches, and that PoC-only validation inflates success rates by 1.83× on average. PatchBench mitigates these issues by selecting vulnerabilities whose true fixes lie outside the crash stack, migrating historical vulnerabilities into new contexts, and employing rigorous validation for security and semantic correctness.
arXiv AI
2d ago
NameTrap: Steering AI Coding Agents Toward Security Vulnerabilities via Variable Names
The paper introduces NameTrap, a source‑code poisoning attack that renames identifiers in third‑party Python files to steer AI coding agents toward specific Common Weakness Enumeration (CWE) vulnerabilities. By iteratively aligning variable names with CWE‑specific conventions, the attack achieves success rates ranging from 22.5% to 75.0% across six agents and four vulnerability categories, outperforming random and neutral renaming strategies. The poisoned files contain no explicit instructions or vulnerable statements, and existing AI‑based and static security analyzers fail to detect the induced weaknesses.
arXiv AI
Jul 24
IssueTrojanBench: Benchmarking AI Coding Agents Against Malicious Issue Requests
arXiv:2607. 20759v1 Announce Type: cross Abstract: AI coding agents powered by LLMs are increasingly integrated into real-world software development, where they generate, edit, and execute code with autonomous access to local files and tools.
arXiv AI
Aug 5
AgenticSCR: An Autonomous Agentic Secure Code Review for Immature Vulnerabilities Detection
arXiv:2601. 19138v2 Announce Type: replace-cross Abstract: Secure code review is critical during pre-integration, where Atlassian developers rely on lightweight analysis tools, while deep security assessment is deferred to later stages, delaying feedback and increasing remediation costs.
arXiv AI
Sep 15
Vulnerability Localization Benchmark: Measuring Agentic Security Analysis at Repository Scale
arXiv:2609.15939v1 Announce Type: cross Abstract: Language-model agents increasingly operate over complete software repositories, yet cybersecurity evaluations primarily measure whether they can dete...