arXiv AI
Secure Agentic Coding through Counterexample-Grounded Feedback
Read the original on arXiv AI →The Flow has not summarised this story yet — read it at arXiv AI.
Related stories
arXiv AI
Jul 28
Execution-Grounded Security Testing for Coding Agents in Software Engineering Pipelines
arXiv:2607. 22569v1 Announce Type: new Abstract: Coding agents are increasingly integrated into system operations, where their tool use can directly modify project artifacts, execution environments, and the underlying system.
arXiv Computation and Language
Sep 15
Toward Secure Code Generation: Bridging Correctness and Security via Task-Adaptive Vulnerability Modeling and Execution-Based Benchmarking
arXiv:2407.02395v3 Announce Type: replace-cross Abstract: Large language models (LLMs) are increasingly used for program synthesis, yet they often generate code that is functionally plausible but ins...
arXiv Computation and Language
Oct 1
SecureVibe: Making Vibe Coding More Secure
SecureVibe is a training recipe designed to enhance the security of vibe coding by explicitly targeting planning and testing for code security. It combines supervised fine‑tuning on a security suite with post‑training methods (SECUREVIBE_rl and SECUREVIBE_hg) that use verifiable execution feedback and hint‑based self‑supervision. The approach outperforms baselines on multiple security coding benchmarks, improving security pass@1 by up to 6.9 points on BaxBench and 11.5 points on SusVibes, while also boosting functionality pass@1 on both security and generic coding tasks.
arXiv AI
Sep 12
Beyond Static Guarantees: Measuring the Static-Pass Dynamic-Fail Gap in Security-Sensitive and LLM-Generated Python Code
The paper introduces the Static‑Pass Dynamic‑Fail (SPDF) phenomenon, showing that static analysis can miss vulnerabilities that are exploitable at runtime. Using a three‑stage pipeline—static scanning, LLM‑driven CWE reasoning, and autonomous exploit verification—it evaluated 1,355 Python samples and found that 14.53% of samples that passed static checks were actually exploitable. The study highlights that static‑analysis success and runtime security are distinct assurance layers, especially for AI‑generated and security‑sensitive code.
arXiv AI
Jun 3
CodeHacker: Automated Test Case Generation for Detecting Vulnerabilities in Competitive Programming Solutions
arXiv:2602. 20213v2 Announce Type: replace-cross Abstract: The evaluation of Large Language Models (LLMs) for code generation relies heavily on the quality and robustness of test cases.
arXiv AI
Jul 31
Graph Is the Verifier: Agentic Reinforcement Learning for Interprocedural Vulnerability Detection
arXiv:2607. 26656v1 Announce Type: cross Abstract: Real-world vulnerabilities often span multiple functions, yet most learning-based detectors classify each function in isolation: on a sample of real CVEs, we find that 71.