Having demonstrated a strong potential for automating vulnerability discovery, AI agents can also be used to attack software systems at scale. Today's software systems need mechanisms to level the playing field by slowing down potential attacks, giving them time to patch vulnerabilities and strengthen software. Along this line, our study of agent trajectories in vulnerability analysis shows a surprising finding: agents produce dramatically different results across real-world code commits that carry the same functionality and the same vulnerability. This phenomenon appears consistently in multiple code domains and vulnerability categories. It motivates us to study natural and functionality-preserving code transformations derived from real-world software development, and their potential as a defense against attacker agents. We build a corpus of natural transformations by mining recurring development patterns from real-world code commits, and apply them to evaluate impact on agentic vulnerability analysis. Our results show that even a single form of transformation can effectively "confuse" frontier agents, e.g., Codex with GPT-6 Sol, reducing successes in vulnerability discovery. We also study different agent failures, whether transformations can be composed to provide stronger protection, and adaptive attackers who seek to reverse them. Overall, our study of natural code transformation significantly expands the research space of using code transformations to defend against malicious agents.
Figures & tables
Figure 1: Vulnerability analysis results of frontier agents (GPT-5.6 Sol with Codex in this example) vary significantly across commits in the same software. Commit 0 is the original version evaluated by the agent; +/- denotes preceding/following commits; the dotted line marks the vulnerability-fixing commit. Bar color = agent results; bar height = agent token cost (% of budget). The table summarizes result variance, with “flip” indicating the agent’s result changed between consecutive commits.
Figure 2: A small change between code commits, c409cca (top) and a88a11c (bottom), flips the agent’s vulnerability analysis from success to failure. a88a11c ’s simple code refactoring (extracting copy-and-transmit into tx_payload ) sends the agent to a false lead, failing to reproduce the crash.
Figure 3: Top 21 most frequently occurring natural transformations identified by mining CommitPackFT, grouped into 3 categories: structure ( ), robustness ( ), and performance ( ). Each card shows a representative code snippet before and after the transformation. Each transformation is then represented as a skill, allowing diverse applications to target codebases. Unlike synthetic transformations, these transformations encode human intent and may be harder for agents to distinguish.
Figure 4: Agent’s success rates (%) under each natural transformation described in Figure 3 for six model–harness combinations. Dashed lines mark the original success rates without transformations. All panels share the same scale. Detailed rates and relative changes are listed in .
Figure 5: Sensitivity analysis for GPT-5.6 Sol with Codex on Original and the two lowest-success transformations per family: S S5 / S S6 , S R1 / S R6 , and S P3 / S P1 . The dashed line marks the default settings we used in Section 4.1 . (a) Success rate against the per-task budget. (b) Mean success rate over the first n of 9 runs at 2.(c)Differentreasoningeffortatfixed2.
Figure 6: Success rates (%) of GPT-5.6 Sol with Codex against an adaptive attacker. Before an attack, the agent rewrites each transformed codebase to make the vulnerability easier to find within $6 budget.
Appendix figures & tables3 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 7: Feature distributions in the original CyberGym benchmark (gray) and the 186 selected tasks (blue). Bars show within-group proportions among tasks with observed values. Dashed gray and solid blue lines mark the respective medians. Codebase size, PoC size, and crash depth use log10(x+1) binning, while SCARINESS scores use linear binning.
Table 4: Success rates (%) under each natural transformation in Figure 3 . Each cell shows the absolute rate above its signed relative change 100(s/sOrig−1) : negative indicates a reduction, positive an increase. Values are truncated to integers after calculation; Orig shows only its absolute rate. Dashes denote missing or undefined values. Means require all six model–harness combinations, with relative changes computed from the mean rates.
ID
Transformation
n
Changed Lines Median [ Q1 , Q3 ]
Files Changed Median
Structure
S1
Imperative to Functional
18
2334 [1512, 5535]
9.5
S2
Extract Shared Logic
18
1878 [1518, 2614]
6.0
S3
Branches to Lookup Table
18
2153 [1018, 3617]
16.5
S4
Nested Branches to Guard Clauses
17
2223 [976, 8084]
61.0
S5
Raw Pointer to RAII
18
368 [283, 546]
3.5
Appendix
Table 5: Quantifying the amount of change to the codebases for each transformation. n is the number of samples. We report the number of line changes (median, quartiles 1 and 3) and the median number of files changed.
Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.
The advent of agentic vulnerability detection is already becoming a watershed moment for software security. Audits conducted entirely by autonomous LLM agents are uncovering critical vulnerabilities in fundamental software underpinning digital society. Many of these vulnerabilities remained masked for years, surfacing only now with AI agents. Yet the reasoning behind these discoveries remains alarmingly opaque and unvalidated. What assumptions did the agent make about a function's inputs when it deemed that function to be secure? Failures in reasoning and incorrect assumptions can lead to missed vulnerabilities and reduce trust in agentic analysis. We propose a security-specification-first paradigm that (1) exposes the agent's tacit assumptions explicitly as security specifications and (2) continuously refines those specifications via runtime falsification. We realize our approach in Code-Augur, a novel harness for agentic vulnerability detection. Given a codebase, Code-Augur analyzes each component of the system for vulnerable code. When it deems a component to be secure, it commits the local invariants behind that judgment as in-source assertions. In parallel, Code-Augur leverages a guided fuzzer to attempt to falsify those assumptions. When the fuzzer triggers an assertion, this either reveals a genuine vulnerability or a flawed specification to refine. In both cases, this process grounds the agent's understanding, aligning its view of code intent with how the code actually behaves. On real-world subjects, Code-Augur effectively leverages security specifications to detect more vulnerabilities than other state-of-the-art agents. Additionally, Code-Augur found 22 new vulnerabilities in key open-source projects. Compared to curated specialized models like Claude Mythos, Code-Augur offers effective agentic vulnerability detection built on widely available LLMs like Sonnet and DeepSeek.
Open-source projects now let AI agents review incoming code, but the code under review may itself come from an AI attacker. We present CyberDual, an arena for this dual role of AI: attacker agents hide an exploitable bug in real maintenance work on widely used open-source projects, and reviewer agents try to find and repair it. Execution decides each match: we rerun the attacker's proof of concept (PoC) on the code that comes out of review. Every attack is new, and the windows can be rebuilt each quarter from the latest upstream history. Three agentic reviewers catch 85-91% of 1,088 valid attacks from six attackers. Yet when the attacker spreads the bug over real upstream commits, about one in six attack slots still ends with a working exploit after review. The strongest attacker has open weights: GLM 5.3 almost never refuses, and its attacks make up 13 of the 28 that get past all three reviewers. When they miss, Claude reviewers mostly approve the attack, while GPT-6-Sol mostly repairs the wrong code; a reviewer from a second vendor catches about two thirds of a Claude reviewer's misses. Beyond a leaderboard, CyberDual has three uses. First, PoC execution gives both sides a reward that agent reports cannot game, so its surviving attacks can train reviewers against stronger attackers. Second, it can gate a release on both scores: Claude Sonnet 5 refuses one in five attack slots, yet attacks about as well as GPT-6-Sol, so refusal alone does not remove attack capability. Third, it can warn the teams behind a deployed reviewer when a new attacker crosses a threshold: GLM 5.3 in Claude Code already gets an exploit past Sonnet 5 in 17% of its attack slots.
As AI systems gain increasing autonomy and execution capability, the number of discovered security vulnerabilities continues to rise. However, many of these vulnerabilities are not fundamentally novel, but instead reflect recurring classes of weaknesses long observed in prior computing systems. Execution-capable AI agents are effectively unbounded, self-modifying programs that interact extensively with multiple layers of the computing stack. This broad interaction surface imposes a significant security burden on developers, who must reason about and secure complex cross-layer behaviors. Prior research has primarily focused on vulnerabilities in open-source agents and agent frameworks. In contrast, it remains unclear whether proprietary agent systems -- developed under stricter coding standards and formal review processes -- exhibit similar security weaknesses. In this paper, we present findings from two penetration tests conducted in 2025 against proprietary agent products and evaluate whether the security posture of AI agents has improved since these assessments.