Coding agents can adapt robotic software by revising executable programs, but successful responses to an evolving opponent may not remain effective. We present a framework for program-level adversarial co-adaptive self-play in which coding agents generate attacks and defenses from tested opponent code and mission feedback, without model fine-tuning. Environment-specific interfaces support external programs for autonomous driving and SDK-level defenses for humanoid locomotion. Two eight-generation case studies reveal concrete software responses: a driving defender introduces direct-actuation recovery, while a humanoid defender revises incoming-state validation. These responses provide local task recovery but do not establish sustained robustness. The framework makes such adaptation and limitations observable through executable artifacts and task-level evidence.
Figures & tables
Figure 1: Program-level adversarial co-adaptation. Coding agents develop attack and defense programs that are checked, frozen, and evaluated in Autoware-CARLA or G1-MuJoCo. Independent referees judge outcomes from simulator ground truth; results and tested opponent code guide the next generation.
Driving
Humanoid
Task
60 m clear-road route
3 m flat-ground walk
Robot software
Autoware in CARLA
G1 policy + navigation in MuJoCo
Coding harness
Claude Code / Opus
Claude Code / Sonnet
Agent budget
40 min per session
60 min per session
Attacker roles
Five fixed
Five orchestrated
Joint episode repetitions
One per attacker
Three per attacker
Table 1: Evaluated configurations. Each uses one eight-generation run and one shared defender per generation.
Figure 2: Driving. A crash, collision, or off-road event results in an attacker win; successful completion results in a defender win; and a timeout results in a tie.
Figure 3: Humanoid. Each box summarizes an orchestrator-assigned task, grouped by attack type. Solid arrows show continuation of a strategy while dashed arrows show borrowed mechanisms. Blue marks eligible matchups where the median of the three joint-episode recovery scores is 1; red marks the remaining eligible matchups. Gray marks attacks that do not disrupt attack-only execution and are excluded from scoring.
Figure 4: Driving. Each column progresses from top to bottom, pairing the Autoware visualization (left) with the simulated vehicle (right). (a) the attacker overwhelms the defender with competing steering commands; (b) the defender mitigates fabricated vehicle detections; (c) a false arrival signal prevents mission completion; (d) the attacker progressively reduces the speed limit to 0 km/h.
Figure 5: Humanoid. Each column progresses from top to bottom. The red marker indicates the goal. (a) IMU spoofing causes a fall without defense; (b) the defender mitigates the same attack; (c) Position drift sends the robot off-route; (d) Combined sensor spoofing and motor-command injection and (e) competing actuator commands both cause falls.