Natural Code Transformation Confuses Agents in Vulnerability Analysis
Along this line, our study of agent trajectories in vulnerability analysis shows a surprising finding: agents produce dramatically different results across real-world code commits that carry the same functionality and the same vulnerability.
ProofPaper ↗
Key points
- Having demonstrated a strong potential for automating vulnerability discovery, AI agents can also be used to attack software systems at scale.
- Today's software systems need mechanisms to level the playing field by slowing down potential attacks, giving them time to patch vulnerabilities and strengthen software.
- We build a corpus of natural transformations by mining recurring development patterns from real-world code commits, and apply them to evaluate impact on agentic vulnerability analysis.
- Overall, our study of natural code transformation significantly expands the research space of using code transformations to defend against malicious agents.
Sources (1)
- [1]Natural Code Transformation Confuses Agents in Vulnerability AnalysisarXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 9, 09:55 PM
Along this line, our study of agent trajectories in vulnerability analysis shows a surprising finding: agents produce dramatically different results across real-world code commits that carry the same functionality and the same vulnerability.
Having demonstrated a strong potential for automating vulnerability discovery, AI agents can also be used to attack software systems at scale.
Extractive summary: sentences quoted from the sources.
Before this
- Oct 9, 2026pydantic/pydantic-ai v2.55.0: v2.55.0 (2026-10-09)
- Oct 9, 2026A new feature for my blog, built using my voice
- Oct 9, 2026Asana cuts model costs 76x in browser tests with GPT-6.1 Sol
- Oct 8, 2026[AINews] not much happened today
- Oct 8, 2026A Closer Look at Agentic BBO: Benchmarking LLM Agents for Black-Box Optimization
- Oct 8, 2026SWE-Duel: Towards a Self-Scaling Arena for Coding Agents