Peer Pressure: Execution-Verified Co-Evolution of Attacker and Defender Populations for Code Security

Khushbu Pahwa; Yubin Ge; Daniele Bonadiman; Xiaofei Ma; Yi Zhang

cs.CROct 17, 2026

Peer Pressure: Execution-Verified Co-Evolution of Attacker and Defender Populations for Code Security

Authors: Khushbu Pahwa, Yubin Ge, Daniele Bonadiman, Xiaofei Ma, Yi Zhang

Organizations: AWS AI

Abstract

LLM code agents increasingly ship code with little oversight, yet defenders trained on static vulnerability datasets fall behind adapting adversaries. We co-train attacker and defender instead, and let execution decide every reward: an attacker (Red) edits a real repository and earns nothing unless its patch applies, builds, passes the tests, completes its development task and reproduces a real exploit in an isolated container, whose path also labels the entry point, the critical operation and the trace between them. Peer-Relative Policy Optimization (PRPO) makes both sides populations of LoRA adapters over one frozen base and credits each against same-role peers that faced an identical condition, placing the population inside the policy-gradient baseline rather than the opponent pool, with a tournament preserving diversity. Matching cancels the condition's difficulty: at equal coverage it is worth 2.3 points of balanced accuracy over a baseline computed on other conditions, and it matches a within-policy control at half the verifier spend. PRPO's 7B diff reviewer reaches 64.8% balanced accuracy on four unseen applications in three untrained languages, 5.5 points above supervised security fine-tuning and 4.4 above a frozen frontier reviewer (Claude Opus 4.8), which it leads by 15.8 on the application it trains on. Its 9B repository agent recovers 23 of 172 held-out VulnGym advisories, against 10 after supervised fine-tuning and 7 for the same backbone untrained under the same scaffold, and locates 17 of 43 reachable entry points against 13 for mini-swe-agent with GLM-5.2. Run unchanged on jailbreak defense, the same algorithm matches or exceeds WildGuard's static F1 at equal corpus and model size. Under a judge distinct from its training oracle it cuts attack success from 36.0% to 4.6%, against WildGuard's 8.9%.

Figures & tables

Figure 1: PRPO at a glance. Red writes patches that complete a development task while hiding a weakness of a known class; each is executed in an isolated sandbox and reviewed by Blue. Red is paid only when a real exploit fires and Blue misses or, at repository level, mislocates it, and the exploit’s path supplies the localization label. (1) One return per peer, the opposing population frozen as a committee. (2) Each peer is credited against its peers on the identical condition, cancelling difficulty and opponent, where a batch-mean baseline mixes conditions. (3) Every

50

rounds the lowest-fitness adapter is evicted and reseeded by mutation or rank-preserving crossover (§ 3 ).

Variant (matched train. budget)	isolates	Src	Unseen	$\Delta$ (paired)
Base (zero-shot)	—	61.4	$55.9{\pm}1.8$	$-8.9^{\ast\ast}$
Security-SFT only	no RL	74.0	$59.3{\pm}1.6$	$-5.5^{\ast\ast}$
Single pair ( $N{=}1$ both)	population	81.0	$61.4{\pm}1.5$	$-3.4^{\ast\ast}$
Ensemble-of-4 (no co-train)	capacity	83.2	$62.2{\pm}1.5$	$-2.6^{\ast\ast}$
Within-policy RLOO ( $G{=}2$ )	allocation	83.8	$62.4{\pm}1.4$	$-2.4^{\ast\ast}$
baseline swapped, population/reward/training budget/surrogate fixed

Table 1: Component ablations: balanced accuracy (%) of frozen Blue, diff-level arm, Setting A (chance

50\%

). Src :

100

held-out scenarios of the training application; Unseen : mean over four unseen applications, mean

{\pm}

SD.

\Delta

: paired contrast against MPA on identical seeds (paired SE

0.4

–

0.6

);

{}^{\ast}p{<}0.05

{}^{\ast\ast}p{<}0.01

, Wilcoxon. App. X.6 .

Figure 2: Arms race (diff-level arm, Setting A). Against a frozen-initial opponent, (a) Red’s certified evasion rises

0.19\!\to\!0.37

and (b) Blue’s balanced accuracy

62\!\to\!89\%

under three credit schemes. (c) Against the current opponent Red’s evasion stays bounded (mean

0.14

, slope n.s.): an arms race, not two stalled policies. Details in App. M .

	Easy ( $110$ adv., $278$ entries)			Medium ( $31$ , $56$ )			Hard ( $31$ , $46$ )
Detector	AR	ER	ES	AR	ER	ES	AR	ER	ES
published, Claude Code (Qwen tiers) and OpenHands (DeepSeek) ( Ji et al., 2026 )
Qwen3.5-9B	6.4	4.3	2.5	3.2	1.8	1.7	0.0	0.0	0.0
Qwen3.5-27B	—	—	—	—	—	—	12.9	8.7	4.6
DeepSeek-V4-Flash	—	—	—	—	—	—	22.6	15.2	11.6
ours, Qwen3.5-9B under mini-swe-agent, repository-level, matched training budget

Table 2: VulnGym T1 (held out), end-to-end detection under the benchmark’s own evaluator, by difficulty stratum. AR: advisory recall; ER: entry recall; ES: edit similarity of the trace over hit entries. Published rows are zero-shot. Bold marks the column best; T2–T4 in Table A9 .

Guard	ASR $\downarrow$ (WG)	ASR $\downarrow$ (LG3)	XSTest refusal $\downarrow$
No guard	36.0	37.1	2.1
WildGuard (7B, released)	8.9	9.6	4.2
Safety-SFT guard	9.2	9.9	3.5
Single pair	8.2	8.9	3.7
Within-policy RLOO ( $G{=}2$ )	6.1	6.8	3.8
Population, global baseline	5.9	6.5	3.9

Table 3: Jailbreak safety. ASR on all

1{,}725

WildGuardTest items against a frozen Qwen3.5-9B target under two judges, neither the training oracle; Llama Guard 3 shares neither the training oracle nor the SFT corpus. Last column is refusal on XSTest’s

250

safe prompts. WildGuard is released and not budget-matched; static

F_{1}

columns are in Table A4 .

Appendix figures & tables19 assets

Supplementary material from the paper’s appendix.

Appendix

Role and setting	Receives, and is withheld
Red, both code arms	Certified site (pre-patch slice of one to three files), development task and target class. No search, verifier output or Blue verdict.
Blue, diff level	Unified diff and post-patch context. Returns a verdict and a confidence, no location. No label, exploit, tools or verifier output.
Blue, repository level	Checkout, a candidate advisory-style report (on a clean condition it describes a weakness considered but not introduced, so it never reveals the label) and read-only tools ( ${\leq}40$ calls). Returns a verdict, a confidence and a located finding. No diff, site or exploit.
VulnGym	The benchmark’s checkout, description, scaffold and evaluator; never trained on.
Red, safety	One seed harmful behavior. No guard weights or classifier output.
Blue, safety	Two calls. Call 1 sees the prompt alone and returns the block probability that gates deployment; Call 2 sees the response and returns the response-level judgements, which enter only $\ell$ and the response $F_{1}$ tasks. No seed behavior or classifier label.

Appendix

Table A1: Observation contract: what each role receives and is withheld in every setting.

Application	Lang.	Role	Upstream repository
Grimoire	TS	train A, B	goniszewski/grimoire (v0.5.0)
Lago	Ruby	train B	getlago/lago
PrestaShop	PHP	train B	PrestaShop/PrestaShop
Pretix	Python	train B	pretix/pretix
OpenEMR	PHP	train B	openemr/openemr
Habitica	JS	train B	HabitRPG/habitica

Appendix

Table A2: The eleven applications. Setting A instruments Grimoire alone; Setting B adds the six business-logic applications. The four transfer applications are held out in both settings and never enter training, SFT or tournament replacement. VulnGym’s

23

repositories are pinned by the benchmark itself and held out whole.

Figure A1: Red’s certified evasion against the current , co-adapting Blue. The series stays within a bounded band rather than trending (mean

0.14

; OLS slope

-5.2{\times}10^{-6}

per step, total drift

-0.005

over

1{,}000

steps), which is the signature of two-sided adaptation rather than one side running away. Error bars are the within-checkpoint binomial

95\%

CI at

n{=}100

Figure A2: Population dynamics. (a) Elo of the four Blue adapters, with dotted verticals at tournament steps where the lowest-fitness adapter was evicted and reseeded, after which its rating returns toward the population mean; the deployed detector is the best-Elo member. (b) Peer correlation

\rho

and (c) strategy coverage, reproduced from Fig. 2 over a denser checkpoint grid.

Figure A3: Trained-checkpoint cross-play (referenced in § 5 ): Red evasion among verifier-certified patches, Blue checkpoints in rows and Red checkpoints in columns. Later Blue (lower rows) suppresses earlier Red; later Red (right columns) evades earlier Blue; contemporaneous play (diagonal) sits near $0.14$ , matching the current-opponent band of Fig. A1 . With $n{=}120$ certified attempts per cell, each cell carries a binomial $95\%$ CI of ${\pm}0.04$ to ${\pm}0.09$ depending on the cell rate. Two-way decomposition gives a strong additive component (Blue main effect spans $0.31$ , Red $0.33$ ) plus an interaction whose variance is six times the binomial sampling variance at $n{=}120$ . This is descriptive: the additive model is fitted on a probability scale where floor effects alone generate non-additivity, so we attach no test; it is suggestive of specialization on top of cumulative skill. We do not report a count of “incomparable” pairs: under the dominance definition, measurement noise alone makes almost every pair of rows cross, so that count sits at its permutation null ( $14.0{\pm}0.9$ of $15$ ) irrespective of structure and cannot distinguish monotone improvement from a cycle.

Credit scheme	Adv. var. $\downarrow$	Ep. $\to$ tgt $\downarrow$	Seed SD $\downarrow$	Coll. $\downarrow$	Bal. acc. $\uparrow$
Global baseline ( $m{=}1$ )	1.00	4.73k	2.1	3/12	85.4
MPA ( $m{=}2$ , default)	0.77	3.57k	0.8	1/12	87.0
MPA ( $m{=}4$ )	0.61	3.41k	0.7	1/12	87.4

Appendix

Table A3: Credit-assignment comparison on the training domain (Grimoire; 12 seeds), matched training budget. “Adv. var.” is the measured variance of the raw scalar advantage , the quantity the identity concerns, relative to the global baseline; “Ep.

\to

tgt” is episodes to a fixed validation target; “Coll.” counts collapsed runs. The scalar-advantage identity

(1{-}\rho)(1{+}\frac{1}{m-1})

\rho{=}0.60

predicts

0.80

for

m{=}2

and

0.53

for

m{=}4

, against measured

0.77

and

0.61

. Agreement is close at the default width (

-3.8\%

relative) and degrades as

m

grows (

+14\%

m{=}4

), as expected if the exchangeability assumption behind the identity weakens as more of a heterogeneous population enters a matched set (App. P ). Widening to

m{=}4

keeps reducing variance but buys only

+0.4

balanced-accuracy points while doubling verified rollouts per condition, so we use

m{=}2

throughout. This diminishing-returns pattern is consistent with a large-scale sweep over

\{8,16,24,32\}

generations per prompt at a fixed total batch, which finds the allocation second-order ( Khatri et al., 2026 ) :

m

buys variance reduction rather than accuracy. The matched width

m

(same-role peers per condition) is distinct from the population size

N

, which sets opponent diversity and the tournament pool.

	WildGuardTest $F_{1}\,\uparrow$ (human labels)			ASR $\downarrow$
Guard	prompt harm	resp. harm	resp. refusal	WG judge	LG3 judge	XSTest refusal $\downarrow$
no guard, and published external guards (not budget-matched)
No guard	—	—	—	36.0	37.1	2.1
Llama Guard 3 (8B)	68.4	63.1	—	11.2	11.8	4.9
WildGuard (7B)	88.9	75.4	88.6	8.9	9.6	4.2
ours, matched training budget, trained on HarmBench $+$ WildJailbreak

Appendix

Table A4: Jailbreak domain. Training uses the HarmBench validation behaviors and WildJailbreak train with HarmBench’s validation classifier as the frozen oracle; evaluation is on WildGuardTest judged by WildGuard. No evaluation judge is the training oracle. Blue’s report covers all three native tasks (block probability for the prompt and two judgements of the target’s response), so no task-specific head is added.

F_{1}

is against WildGuardTest’s human labels with non-agreement items excluded per task. Two caveats apply to the response columns: the

\ell

term is gated on harmful conditions, so those heads receive no training signal on benign draws, and the response-harm head is trained on

\mathcal{H}_{\text{val}}

’s verdicts, so its

F_{1}

partly measures that oracle’s agreement with human labels. The prompt-harm column is also read at the deployment threshold of

\tfrac{1}{2}

against a response-conditioned training label, which differs from WildGuardTest’s prompt-harmfulness label; Llama Guard does not emit a refusal label. The final column is end-to-end refusal on XSTest’s

250

safe prompts, averaged over seeds for our rows; the no-guard cell is the target model’s own refusal rate, the floor the guarded rows add to. ASR is reported under two independent judges which agree on

91\%

of items of the no-guard attack pool (Cohen’s

\kappa{=}0.81

), less on the low-ASR rows, where the attack sets are small. External guards are evaluated as released and are not budget-matched. Our warm start uses the same WildGuardMix train split at the same model size, so the comparison holds corpus and scale fixed and differs in objective. Qwen3Guard-8B ( Qwen Team, 2025 ) reaches

88.9

prompt-harm and

78.9

response-harm

F_{1}

on this split, so response-harm remains above our row. Our guard’s advantage is attack success behind it, where it is the strongest row under both judges, and over-refusal stays roughly flat as harmful recall improves (

3.5\%

at the warm start to

3.8\%

for PRPO, against WildGuard’s

4.2\%

). Bold marks the best value per column.

Figure A4: Unseen-application accuracy against verifier spend (diff-level arm). A candidate-equivalent is one build, test run and exploit probe. The global baseline has MPA’s coverage yet stays

{\approx}2.3

points lower; within-policy RLOO covers half as many conditions per adapter, and its deficit shrinks with budget. Bars are SEs over twelve seeds.

Quantity	What it establishes	Jailbreak (code)
Red vs. frozen-initial Blue	attacker capability	$0.14\!\to\!0.41$ ( $0.19\!\to\!0.37$ )
Red vs. current Blue	two-sidedness, bounded band	mean $0.11$ , slope n.s.
Blue vs. frozen-initial Red	defender capability	$0.52\!\to\!0.71$ F 1 ( $62\!\to\!89\%$ bal. acc.)
Peer correlation $\rho$	is the estimator in regime?	$0.57$ CI $[0.48,0.65]$ ( $0.60$ )
Predicted variance ratio	$(1-\rho)\tfrac{m}{m-1}$	$0.86$ ( $0.80$ )
Measured advantage variance	does the prediction hold?	$0.83$ , $-3.5\%$ ( $0.77$ , $-3.8\%$ )

Appendix

Table A5: The jailbreak domain exercises both roles and reproduces the credit mechanism. Code-domain values are in parentheses. Red’s success against a frozen-initial guard rises, so the attacker is learning; against the current guard it stays in a bounded band, the two-sided signature. The peer correlation’s point estimate clears

1/m{=}0.5

, but its interval’s lower bound (

0.48

) falls marginally below, so the regime condition is weaker here than in the code domain (

[0.52,0.67]

); the measured variance ratio again matches the identity to within

4\%

. Family coverage is the jailbreak analogue of concealment-axis coverage over the six tactic families.

Figure A5: Prompt-level case study: windowed evasion on the pinned CWE-89 vector, with no weight updates. The

6

-round windowed evasion rate (

\mathrm{FN}/\mathrm{Vuln}

) is non-monotonic, but denominators are small (

n

annotated per window,

2

–

4

vulnerable rounds each), so we also draw the range a fixed policy would produce at the pooled rate

p{=}0.45

. All six windows fall inside that band. The oscillation is therefore consistent with sampling noise and does not by itself demonstrate adaptation; the suggestive evidence in this experiment is the timing of skill pruning (§ R ), not the shape of this curve.

Window	Vuln/Clean	TP	TN	FP	FN	Evasion
Rounds 1–6	2 / 4	1	3	1	1	0.50
Rounds 7–12	4 / 2	3	2	0	1	0.25
Rounds 13–18	4 / 2	1	2	0	3	0.75
Rounds 19–24	3 / 3	1	1	2	2	0.67
Rounds 25–30	4 / 2	2	2	0	2	0.50
Rounds 31–36	3 / 3	3	2	1	0	0.00

Appendix

Table A6: Per-window outcomes (6-round windows). Vuln/Clean counts rounds where Red injected a verified vulnerability versus a benign commit; Evasion is

\mathrm{FN}/\mathrm{Vuln}

Component	Count
Total source files	152
API route handlers	41
Database modules (Drizzle ORM)	21
Svelte UI components	58
Authentication handlers	2
Configuration files	8

Appendix

Table A7: Grimoire application structure.

CWE	Name	Tier	Grimoire attack surface
CWE-89	SQL Injection	High	Drizzle ORM queries, 6 repositories
CWE-79	Cross-Site Scripting	High	@html directives in Svelte components
CWE-78	OS Command Injection	High	Server-side utility scripts
CWE-22	Path Traversal	Medium	File upload and bookmark import
CWE-862	Missing Authorization	Medium	Route guards on state-changing endpoints
CWE-918	Server-Side Request Forgery	Medium	Bookmark URL fetching

Appendix

Table A8: Targeted vulnerability classes and their sampling tiers.

	T2: EP identification			T3: CO localization			T4: trace construction
Detector	FR	LR	FP	FR	LR	FP	ES	TNR	TNP
published frontier coding agents holding the column maxima ( Ji et al., 2026 )
mini-swe-agent, GLM-5.2	30.2	18.6	11.1	39.5	18.6	2.5	36.4	49.5	23.3
mini-swe-agent, DeepSeek-V4-Flash	16.3	7.0	3.5	51.2	16.3	1.6	27.8	37.7	16.1
Claude Code, GLM-5.2	25.6	9.3	6.0	48.8	30.2	5.2	32.1	39.9	19.8
Claude Code, DeepSeek-V4-Flash	14.0	4.7	1.7	34.9	16.3	0.9	34.7	54.0	20.2

Appendix

Table A9: VulnGym T2–T4, Hard stratum, scored by the benchmark’s own evaluator. FR and LR are file and line recall, FP finding precision, TNR and TNP trace node recall and precision; FP and TNP are the only metrics here that price over-prediction, and one Hard target is

2.33

points of recall. The published block lists the five of nine scaffold

\times

model combinations holding a column maximum, two of which (mini-swe-agent) share our scaffold and so differ from our rows only in the policy. No published Qwen3.5-9B row exists for T2–T4, which Ji et al. (2026) report for frontier models only, so our zero-shot row is the within-scaffold reference. Bold marks the column best.

Method	Grim. (src)	Mini.	Book.	File.	Plaus.	Mean unseen
Security SFT	74.0	59.4	58.6	62.3	56.8	59.3
Single-pair R++	81.0	63.6	60.5	63.6	57.9	61.4
Ensemble-of-4	83.2	64.5	62.2	63.8	58.3	62.2
Within-policy RLOO	83.8	63.0	64.2	64.3	58.1	62.4
same population, reward, budget and surrogate; baseline swapped
learned critic (GAE)	82.6	62.8	62.4	65.0	57.8	62.0

Appendix

Table A10: Balanced accuracy (%) on the source application (Grimoire) and four unseen applications, frozen Blue with no application-specific tuning; mean over twelve training seeds, per-column SD

1.4

1.7

; contrasts are paired within seed, with a paired SE of

0.4

0.6

. Peer-relative credit reaches

64.8

mean on the four unseen applications,

+3.4

over a single pair and

+5.5

over security SFT, and leads on the source application and on three of the four unseen ones; OPO edges it on Plausible (

61.7

against

61.2

), within one seed-level SD and the single reversal across the block. Per-application levels track each application’s class mix rather than its language alone: FileBrowser is dominated by path traversal, the class detected best, and Plausible by broken authorization, the class detected worst (App. W.4 ). The targets span Go, PHP and Elixir against a TypeScript training application, so each column is a joint repository, framework and language shift. The lower block holds the population, reward, training budget, and clipped surrogate fixed and swaps only the advantage baseline. Two orderings hold on the unseen mean but not in every column: critic-free baselines beat a learned value head, which underfits a sparse verifier reward at this budget; and among critic-free baselines, leave-one-out over distinct peers

>

length-weighted group mean ( Hao et al., 2025 )

>

global/batch mean. The primary isolation remains the budget-matched within-policy RLOO row (

+2.4

here), which the main table decomposes further with a step-matched control; the OPO row isolates group-mean versus leave-one-out credit at matched coverage. The source-to-unseen difference lies in a band across the reinforcement-learned variants (

19.6

22.9

points), against security SFT’s smaller

14.7

, so it tracks the distribution shift rather than the credit scheme; SFT’s smaller gap reflects its lower in-domain score. Learned detectors have lost more than half their performance under realistic data ( Chakraborty et al., 2021 ) .

#	Result	Backbone	Training data	Evaluation set	Metric
1	Co-evolution vs. static (§ 5 )	Qw2.5-Coder-7B , diff	Setting A	src. held-out; $4$ unseen apps, $400$ paired	bal. acc.
2	VulnGym T1 (Table 2 )	Qwen3.5-9B , repo	Setting A, B	T1; $110/31/31$ adv., $278/56/46$ entries	AR, ER, ES
3	VulnGym T2–T4 (Table A9 )	Qwen3.5-9B , repo	Setting A, B	T2–T4, Hard; $43$ reference targets	FR, LR, FP; ES, TNR, TNP
4	Transfer and composition (§ 5 )	Qw2.5-Coder-7B , diff	Setting A vs. B	$4$ unseen apps, $400$ paired	bal. acc.; TPR@FPR ${=}0.1$
5	Co-evolution dynamics (Fig. 2 )	Qw2.5-Coder-7B , diff	Setting A	frozen-initial and current opponent	evasion; bal. acc.; $\rho$
6	Component ablations (App. Y )	Qw2.5-Coder-7B , diff	Setting A	$4$ unseen apps, $400$ paired	bal. acc.

Appendix

Table A11: What each result is measured on. “diff” and “repo” are the two action-space granularities of § 3.2 ; the two code arms are trained separately and no adapter is moved between them. VulnGym is held out whole in every row. Rows 2 and 3 additionally quote published coding agents from Ji et al. (2026) , which are zero-shot and not budget-matched.

Figure A6: Blue on the training application, diff-level arm. (a) Sensitivity and specificity rise together,

0.66\!\to\!0.86

and

0.66\!\to\!0.88

, so the gain is discrimination rather than a shifted threshold; a detector that simply rejected more would trade one against the other. Their mean is the

87.0\%

of Table 1 . (b) Episode outcomes, which partition every episode. Correct decisions rise while both error types fall, and the false-positive share settles near

0.03

, the operating point

\lambda_{\text{FP}}

enforces. False negatives plateau near

0.12

of episodes rather than vanishing, which is a miss rate of

0.17

on vulnerable episodes: Red keeps a residual hit rate against a defender that is still improving. That rate is not the certified evasion per attempt of Fig. 2 c, whose denominator is every attempt, including those that fail

F

, and so is larger than the vulnerable-episode denominator here.

Control	What it tests	Result (bal. acc. % unless noted)
co-evolution endpoints (§ 4 )
Held-out external attacker	holds up vs. an attacker outside the loop	$62.3$ absolute; not paired with SFT’s $59.3$
Frozen frontier reviewer	is a capable model enough on its own?	src $68.4$ / $71.2$ vs. $87.0$ ; unseen $58.9$ / $60.4$ vs. $64.8$
Freeze Red, train Blue	does the opponent drive gains?	$60.8$ vs $64.8$ ( $-4.0$ )
Freeze Blue, train Red	symmetric check	evasion $0.19\!\to\!0.37$ , then flat
Historical Blue robustness	no forgetting on the defence	catches $94.2\%$ of earlier evasions

Appendix

Table A12: Controls and diagnostics, diff-level arm. Balanced accuracy on the four unseen applications unless stated. The two freeze rows are the intervention test: holding one side fixed removes most of the co-evolution gain, which is the behavior the design predicts. The historical rows test for forgetting in both directions. The real-advisory row is a small-sample check at

n{=}30

and is reported for direction.

arm	diffs per condition	adapters per condition	samples per adapter	distinct conds. per adapter
MPA ( $m{=}2$ )	2	2	500	500
within-policy RLOO ( $G{=}2$ )	2	1	500	250
RLOO, $2\times$ generations	2	1	1000	500
global baseline ( $m{=}1$ )	1	1	500	500

Appendix

Table A13: Every arm but one consumes the same

2{,}000

candidate-equivalents and the same number of optimizer updates and samples per adapter. The quantity that differs is the number of distinct conditions each adapter is trained on: MPA spends its two generations per condition on two adapters where RLOO spends both on one, so RLOO covers half as many conditions at the same verifier spend. The

m{=}1

global baseline authors one diff per condition and runs twice as many conditions to reach the same budget, giving it MPA’s coverage with an unmatched baseline; it isolates the matched-condition property.

AI Agent Security

Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.

See all 510 papers

Oct 24, 2026

Can Agentic Code Review Catch Vulnerabilities Before They Are Merged?

LLM agents have been increasingly adopted for security-focused code review, but existing benchmarks mostly derive the reviewed changes from their later fixes instead of the real-world bug-introducing commits. In this paper, we present SecPRBench, the first comprehensive benchmark for evaluating agentic security review on validated real-world code changes. More specifically, we have built an automated agentic pipeline to autonomously harvest, build, and validate massive real-world bug-introducing commits for popular software systems. To ensure precise evaluation, we also adopt LLM-as-a-judge to credit the findings matching ground-truth vulnerabilities. To date, we have collected 265 tasks from nine critical systems, including Firefox, V8, and OpenSSL with millions of lines of code. Across eight frontier models, recall ranges from 32.5% to 78.1%, with Grok 4.6 and GPT-6 sol ranking at the top. Our study also shows that most misses are not simply oversights: in 68% of them, the agent reports on a file that holds the flaw but argues for a different mechanism. Security-focused harnesses also behave differently: OpenAI's Codex Security lowers recall by 8.3 points, mostly by abstaining, while Anthropic's Defending Code harness raises it by 7.7 points, at a higher cost.

Yihan Yang, Chenyuan Yang, Zijie Zhao +5

University of Illinois Urbana-Champaign · Quantum AI & Cyber Security Institute, FPT Corporation; work done during an internship at UIUC.

AI Agent Security Benchmarks Automated Code Review Software Vulnerability Detection LLM Agent Evaluation

Ask PDF

Jun 11, 2026

SEVRA-BENCH: Social Engineering of Vulnerabilities in Review Agents

Large language models (LLMs) are increasingly deployed in automated code-review systems, where their approvals can determine which code is merged into shared repositories. However, it is unclear whether review agents can detect vulnerability-introducing code when an attacker controls both the code change and the persuasive Pull Request (PR) narrative designed to mask it. We introduce SEVRA-BENCH (Social Engineering of Vulnerabilities in Review Agents), a benchmark that measures how often a review agent approves such adversarial PR s. Each PR in SEVRA-BENCH is built from a historical commit that fixed a vulnerability. We automatically reverse that fix to extract the original vulnerable code, and submit the resulting code change as a PR wrapped in one of 15 social-engineering framings. To test review-agent resilience to narrative manipulation, these framings vary dimensions such as supporting evidence, conveyed urgency, signals of prior approval, and appeals to authority. SEVRA-BENCH evaluates a retained challenge split of roughly 1000 adversarial PRs drawn from publicly disclosed vulnerability fixes across the top 10 entries of the MITRE's 2025 most dangerous software weaknesses. Evaluating 8 review agents against this benchmark, we reveal that review agents are susceptible to narrative manipulation, exposing a significant gap in security capabilities.

Rui Melo, Riccardo Fogliato, Sean Zhou +2

1Carnegie Mellon University · 2Microsoft Core AI · 3Independent Researcher +1

Software Vulnerability Detection AI Agent Security LLM Agent Security AI Agent Security Benchmarks Automated Code Review

Ask PDF

Oct 25, 2026

CyberDual: AI Attackers versus AI Code Reviewers in Real Software Maintenance

Open-source projects now let AI agents review incoming code, but the code under review may itself come from an AI attacker. We present CyberDual, an arena for this dual role of AI: attacker agents hide an exploitable bug in real maintenance work on widely used open-source projects, and reviewer agents try to find and repair it. Execution decides each match: we rerun the attacker's proof of concept (PoC) on the code that comes out of review. Every attack is new, and the windows can be rebuilt each quarter from the latest upstream history. Three agentic reviewers catch 85-91% of 1,088 valid attacks from six attackers. Yet when the attacker spreads the bug over real upstream commits, about one in six attack slots still ends with a working exploit after review. The strongest attacker has open weights: GLM 5.3 almost never refuses, and its attacks make up 13 of the 28 that get past all three reviewers. When they miss, Claude reviewers mostly approve the attack, while GPT-6-Sol mostly repairs the wrong code; a reviewer from a second vendor catches about two thirds of a Claude reviewer's misses. Beyond a leaderboard, CyberDual has three uses. First, PoC execution gives both sides a reward that agent reports cannot game, so its surviving attacks can train reviewers against stronger attackers. Second, it can gate a release on both scores: Claude Sonnet 5 refuses one in five attack slots, yet attacks about as well as GPT-6-Sol, so refusal alone does not remove attack capability. Third, it can warn the teams behind a deployed reviewer when a new attacker crosses a threshold: GLM 5.3 in Claude Code already gets an exploit past Sonnet 5 in 17% of its attack slots.

Chenyuan Yang, Hwiwon Lee, Jongseong Kim +4

AI Agent Security Benchmarks Automated Code Review Automated Red Teaming Software Vulnerability Detection

Ask PDF

Abstract

AI Agent Security

Explore similar work

Can Agentic Code Review Catch Vulnerabilities Before They Are Merged?

SEVRA-BENCH: Social Engineering of Vulnerabilities in Review Agents

CyberDual: AI Attackers versus AI Code Reviewers in Real Software Maintenance