Coding Agents Propagate Vulnerabilities in Code Bases

Summary

This research study examines whether vulnerabilities already present in a codebase cause coding agents to write similar vulnerabilities in new code. Across 96 backend tasks and 20 pairs of real C/C++ repository tasks focused on memory safety, insecure existing code made agents write vulnerable code more often, with a 3.4% average reduction in correct and secure backend implementations and a 35.4% average gap between secure and insecure C/C++ contexts. Security-focused prompting did not stop the propagation, and agents attributed their choices to existing code in 76.5% of cases even though they recognized the vulnerability in 69.9%.

Topics

• AI agents