Organizations: University of Athens · National Infrastructures for Research and Technology · Athens University of Economics and Business · National Cybersecurity Authority of Greece
Automated Code Review (ACR) systems integrating Large Language Models (LLMs) are increasingly adopted in software development workflows, ranging from interactive assistants to autonomous agents in CI/CD pipelines. In this paper, we study how LLM-based vulnerability detection in ACR is affected by the framing effect: the tendency to let the presentation of information override its semantic content in forming judgments. We examine whether adversaries can exploit this through contextual-bias injection (crafting PR metadata to bias ACR security judgments) as a supply-chain attack vector against real-world ACR pipelines. To this end, we first conduct a large-scale exploratory study across 6 LLMs under five framing conditions, establishing the framing effect as a systematic and widespread phenomenon in LLM-based vulnerability detection. We then design a realistic and controlled experimental environment, evaluating 33 CVEs across 20 real-world projects and two popular ACR pipelines (Claude Code and CodeRabbit), to assess the susceptibility of real-world ACR pipelines to vulnerability re-introduction attacks. We employ two attack strategies: a template-based attack inspired by prior related work, and a novel LLM-assisted refinement attack. We find that template-based attacks are ineffective and may even backfire, as direct biasing attempts raise suspicions. Our refinement attack, on the other hand, is successful in 32/33 (97%) cases, exploiting a fundamental asymmetry: attackers can iteratively refine attacks against a local clone of the review pipeline, while defenders have only one chance to detect them. Overall, our findings highlight the dangers of over-relying on ACR and stress the importance of human oversight and contributor trust in the development process.
Figures & tables
Fig. 1 : Applying our end-to-end workflow to generate a passing pull request (PR) that reintroduces CVE-2024-56143 [ 2 ] to the strapi project. First, we revert the associated fixing commit (①) and construct a PR (②) by applying our seed prompt (Fig. 4 ). Then, we submit (③) this initial PR to a private clone of the strapi repository. If rejected, we employ an LLM to refine the PR (④) using feedback from the rejection review and repeat (⑤) until accepted (⑥).
Fig. 2 : Overview of our controlled bias experiment.
CWE
Language
Vuln.
Patched
CWE-25
79 (XSS)
PHP
49
50
#1
79 (XSS)
JavaScript
50
50
#1
89 (SQL Injection)
PHP
49
50
#2
125 (Buffer Read)
C
50
50
#8
787 (Buffer Write)
C
49
50
#5
Total
247
250
TABLE I : Dataset composition and characteristics.
Fig. 3 : Supply-chain attack threat model: adversaries craft malicious PRs with bias-inducing metadata to reintroduce known vulnerabilities in projects with LLM-based ACR.
(a) Seed prompt for initiating the revert attack.
Fig. 5 : LLM-assisted refinement attack: In case of rejection the adversary refines the PR based on review feedback. The process stops upon approval (attack success) or after t attempts (attack failure). In our experiments, t=10 (11 reviews total).
Project
Lang.
CVE
CWE
B-1
B-2
D-1
D-2
Claude Code (17 CVEs)
strapi
TS, JS
2024-56143
639
✓
–
×
–
2024-34065
294
×
✓
×
–
xbmc
C++
2023-30207
369
×
✓
×
–
2023-23082
787
×
✓
×
–
cherry-studio
TS
2025-54063
94
✓
–
×
–
TABLE III : LLM-assisted iterative attack results for 33 reintroduced CVEs against Claude Code and CodeRabbit ACR pipelines. B-1 : adversarial PR, Seed Prompt ( n=0 ); B-2 : with iterative refinement; D-1 : PR description redacted; D-2 : PR description, commit message and code comments redacted. CWE numbers omit the “CWE-” prefix. Lang. shows languages: TS=TypeScript, JS=JavaScript, Py=Python, Rb=Ruby. Grayed-out rows pass at the baseline. ✓ = accept; × = reject; ⊙ = unclear; – = not tested.
Fig. 6 : Share of adversarial PRs accepted at each attack stage. The X-axis shows: baseline ( B ), best bias template ( T ), seed prompt ( SP ) and refinement rounds 1–10; from SP onward, each bar counts all PRs accepted up to and including that round. Each bar is split by how many of five repeat reviews also accepted each PR, from 0/5 ( red ) to 5/5 ( green ).
Appendix figures & tables1 asset
Supplementary material from the paper’s appendix.
Appendix
Redacted channel
PRs accepted
Variant
Description
Commit msg.
Comments
Claude Code
CodeRabbit
Baseline
–
–
–
1/17
3/16
B-2
–
–
–
17/17
15/16
D-1
∙
–
–
5/17
11/16
D-2A
∙
∙
–
1/17 †
4/16
D-2B
∙
–
∙
1/17 †
4/16
Appendix
TABLE IV : Metadata redaction variants and the number of adversarial PRs still accepted under each, out of 17 (Claude Code) and 16 (CodeRabbit) CVEs. Baseline is the unbiased revert PR. B-2 is the refined adversarial PR without redaction. ∙ = channel redacted. † = the remaining acceptances are exactly the PRs also accepted at the baseline.
Researchers and practitioners increasingly apply Large Language Models (LLMs) for automated vulnerability detection. Recent work has shown that LLMs are susceptible to the same cognitive heuristics that bias human judgment. Yet, no work has investigated whether these heuristics affect a model's assessment of code vulnerabilities. In this paper, we present the first systematic exploration of cognitive heuristics in LLM-driven code vulnerability detection. We introduce a controlled framework that holds the code fixed and only varies the surrounding context to trigger three cognitive heuristics: the halo effect through author attribution, the framing effect through task objectives and consequences, and the anchoring effect through prior analysis results. Within this framework, we evaluate eight LLMs across three programming languages. Our results demonstrate that all evaluated models are susceptible to these heuristics. Cross-model average susceptibility is highest for framing at 33.2%, followed by anchoring at 23.5% and halo at 18.4%. Vulnerabilities that require semantic reasoning for detection are more susceptible to cognitive heuristics than those identifiable through pattern matching. Furthermore, models often change their verdict from safe to vulnerable based on the cognitive condition, without accurately identifying the actual vulnerability. To highlight the practical impact, we demonstrate a proof-of-concept black-box cognitive attack that can suppress up to 97% of previously detected vulnerabilities. Together, these findings show that cognitive bias is a consistent and exploitable property of LLM-based vulnerability detection.
Asif Shahriar, Hongyu Cai, Hadjer Benkraouda +2
BRAC University · Purdue University · University of Illinois Urbana-Champaign
AI-assisted code review is widely used to detect vulnerabilities before production release. Prior work shows that adversarial prompt manipulation can degrade large language model (LLM) performance in code generation. We test whether similar comment-based manipulation misleads LLMs during vulnerability detection. We build a 100-sample benchmark across Python, JavaScript, and Java, each paired with eight comment variants ranging from no comments to adversarial strategies such as authority spoofing and technical deception. Eight frontier models, five commercial and three open-source, are evaluated in 9,366 trials. Adversarial comments produce small, statistically non-significant effects on detection accuracy (McNemar exact p > 0.21; all 95 percent confidence intervals include zero). This holds for commercial models with 89 to 96 percent baseline detection and open-source models with 53 to 72 percent, despite large absolute performance gaps. Unlike generation settings where comment manipulation achieves high attack success, detection performance does not meaningfully degrade. More complex adversarial strategies offer no advantage over simple manipulative comments. We test four automated defenses across 4,646 additional trials (14,012 total). Static analysis cross-referencing performs best at 96.9 percent detection and recovers 47 percent of baseline misses. Comment stripping reduces detection for weaker models by removing helpful context. Failures concentrate on inherently difficult vulnerability classes, including race conditions, timing side channels, and complex authorization logic, rather than on adversarial comments.
Large language models (LLMs) are increasingly deployed in automated code-review systems, where their approvals can determine which code is merged into shared repositories. However, it is unclear whether review agents can detect vulnerability-introducing code when an attacker controls both the code change and the persuasive Pull Request (PR) narrative designed to mask it. We introduce SEVRA-BENCH (Social Engineering of Vulnerabilities in Review Agents), a benchmark that measures how often a review agent approves such adversarial PR s. Each PR in SEVRA-BENCH is built from a historical commit that fixed a vulnerability. We automatically reverse that fix to extract the original vulnerable code, and submit the resulting code change as a PR wrapped in one of 15 social-engineering framings. To test review-agent resilience to narrative manipulation, these framings vary dimensions such as supporting evidence, conveyed urgency, signals of prior approval, and appeals to authority. SEVRA-BENCH evaluates a retained challenge split of roughly 1000 adversarial PRs drawn from publicly disclosed vulnerability fixes across the top 10 entries of the MITRE's 2025 most dangerous software weaknesses. Evaluating 8 review agents against this benchmark, we reveal that review agents are susceptible to narrative manipulation, exposing a significant gap in security capabilities.
Rui Melo, Riccardo Fogliato, Sean Zhou +2
1Carnegie Mellon University · 2Microsoft Core AI · 3Independent Researcher +1