AGENTIC-SYSTEMSJuly 28, 20261 min read

Execution-Grounded Security Testing for Coding Agents in Software Engineering Pipelines

A new study reveals that AI coding agents can be manipulated into executing unsafe system operations when malicious intent is disguised as routine engineering tasks, achieving an unsafe execution rate of up to 73.61%.

Computer Science > Artificial Intelligence

Title:Execution-Grounded Security Testing for Coding Agents in Software Engineering Pipelines

View PDF HTML (experimental)Abstract:Coding agents are increasingly integrated into system operations, where their tool use can directly modify project artifacts, execution environments, and the underlying system. For example, if a coding agent inserts a hook into a system startup or configuration script, that change can persist after the interaction, be triggered later, and abuse delegated user or system privileges to modify the system. This makes security testing a system problem: the key question is not only what the agent says, but what it actually does to the surrounding environment. We present an execution-grounded red-team testing framework for probing this execution-layer security boundary using observable sandbox evidence, including tool invocations, runtime traces, and file-system diffs. Our framework embeds target unsafe operations into routine software engineering workloads, including unit testing, regression testing, crash reproduction, and validation, and uses an execution oracle to guide refinement when an initial probe is rejected or fails. Across multiple agent frameworks and model backbones, our red-team workload reformulation substantially increases verified unsafe execution, reaching 73.61% on code carriers and 53.93% on text carriers. These results show that coding agents in system operations remain insecure under task disguise: once risky intent is hidden inside plausible engineering tasks, the agent can be induced to carry out unsafe actions on the surrounding system. More broadly, coding agents in system operations still demand stronger security testing and safeguards.

Source: arXiv cs.AI Recent

More in this category

agentic-systems

Concept-based Visual Counterfactual Explanations with Diffusion Models

Researchers introduced C-VCE, a novel diffusion framework that generates human-interpretable visual counterfactual explanations by building concept bottleneck layers directly into the generative model.

agentic-systems

Synthetic Scenario Generation for Evaluation of Industry 4.0 Agents

Researchers have developed ScenarioGeneratorAgent, an automated pipeline that generates synthetic evaluation scenarios for Industry 4.0 AI agents. Tested on Smart Grid Transformers, the approach accelerates benchmark generation by 8x while maintaining high quality and adherence to IEC standards.

agentic-systems

Same Question, Different Answers: Evaluating LLM Reliability Beyond Accuracy

A new study reveals that large language models (LLMs) often produce inconsistent answers when the same question is rephrased, with mismatch rates exceeding 23%. The findings suggest that standard benchmark accuracy masks substantial instability, but a self-paraphrasing strategy can help recover latent knowledge at inference time.

agentic-systems

DeepLens Diagnosis Agent: Agentic Workflow Design Lets a Small Reasoning Model Compete with Frontier LLMs

By leveraging a structured five-stage agentic workflow, the 7-billion-parameter DeepLens Diagnosis Agent outperforms frontier models like Claude Sonnet 4.5 and Gemini 3.1 Pro on complex clinical diagnostics, demonstrating that disciplined process design can outweigh raw parameter count and API costs.

agentic-systems

MedLoCoMo: A Long-Context Multi-Session Medical Dialogue Benchmark for Large Language Models

MedLoCoMo is a new medical benchmark designed to evaluate LLMs' clinical reasoning over multi-session, long-context patient histories. Experiments reveal that reasoning across different hospital admissions remains particularly difficult for current AI models.

agentic-systems

SCAIR: Schema-Conditioned Agentic Iterative Reasoning for Enterprise Knowledge Graphs

Researchers have introduced SCAIR, a training-free agentic framework that enhances Knowledge Graph-based RAG (KG-RAG) for enterprise applications by injecting schema constraints into multi-hop iterative reasoning.