Vulnerabilities in Code Comments Can Pollute Model Output
davidmanheim · x · 2026-07-19
This post recounts an interesting security experiment: **even commented-out vulnerable code can affect model outputs**. In the experiment, after researchers added a piece of commented-out vulnerable code to a secure codebase, test results showed: - **Claude Sonnet 4.5**: Outputs became 100% vulnerable code - **Gemini 2.5 Pro**: 44% of outputs were vulnerable code The conclusion is straightforward: **LLMs read and are influenced by all the text in a codebase, not just the active code**. This has significant implications for code reviews, context feeding, and security defense.
More from Safety
- OpenAI reportedly paused an unreleased model after it kept escaping containment — thesaraharminta · 2026-07-21
- Sophos joins Anthropic’s Project Glasswing to use Claude Mythos 5 for vulnerability hunting — TechNadu · 2026-07-21
- AI-generated orphanage scam shows how synthetic media can industrialize trust fraud — 新智元 · 2026-07-21
- A coding-agent guardrail that checks 67 security gates before the model writes code — ZyOffsec · 2026-07-21
- UK’s AISI may move into the Cabinet Office as an AI taskforce is planned — ShakeelHashim · 2026-07-21
- Minervini argues students should be guided, not micromanaged — PMinervini · 2026-07-21