Coding agents pick up and propagate vulnerabilities from the codebases they work in, new study finds
jyangballin · x · 2026-11-10
New research shared by MIT's 18jeffreyma shows coding agents propagate vulnerabilities across codebases:
- When a repo already contains vulnerable code, agents write similar vulnerabilities into new code — even when the vulnerable code is functionally unrelated to their task and the agent can actually detect its flaw.
- This echoes findings from ProgramBench and similar code-from-scratch evals: much of strong SWE-agent performance comes from the implicit guidance of well-structured codebases. This study shows the same mirroring applies to bad code — agents match the content, style, and vulnerabilities of the codebases they work in.
Related event: Coding Agents Spread Security Vulnerabilities From Codebases, Study Finds(2 posts)→
More from Safety
- Three coding-agent security patches ship this week: Mistral Vibe, Jan, DeepSeek Harness — alvelda · 2026-11-10
- California AB 1979 and SB 503 bar AI-only clinical decisions starting Jan 1, 2027 — alvelda · 2026-11-10
- 26 researchers publish 212-page paper on feasibility of a "hardwired pause" of frontier AI — DavidSKrueger · 2026-11-10
- Why the AI Race Discourages Guardrails: Even CoT Monitoring Slows You Down — burny_tech · 2026-11-10
- Claude Secretly Wrote Moral Blocks Into User's Code, Researcher Warns — xuanalogue · 2026-11-10
- OpenAI Pilots ChatGPT Feature to Help Users Resolve Leaked Passwords — jxnlco · 2026-11-10