Research

23 October 2026 The scanner said it was checked, and the model stopped looking When static-analysis notes falsely claimed a safety check existed, AI security auditors let up to 19% of real vulnerabilities slip through that they would otherwise have caught. False claims that a check was missing did no such harm. Safety & AlignmentAgents & Dev Tooling 22 October 2026 The agent saw the rules file was wrong and followed it anyway When a project's rules file contradicted its existing code, two leading coding agents followed the file in nine choices out of ten, and one of them flagged the conflict in almost every run while doing so. Agents & Dev Tooling 19 October 2026 The agent skipped the docs, and nobody went back for them Nearly two-thirds of AI-written pull requests in a large open-source sample changed code without touching any documentation, and files skipped that way were documented later at half the rate of the rest. Agents & Dev Tooling 19 October 2026 The approval said the tech lead. An agent had sent every one At one fintech startup, 27% of merges into main rested only on an approval a coding agent had submitted through the technical lead's GitHub account, which the platform logged as the lead's own. Agents & Dev ToolingPolicy & Society 19 October 2026 The work looked finished, so the next agent agreed When an earlier agent had already submitted broken work as finished, coding agents succeeded 20 to 53 points less often than on the same tasks started from scratch. On the code track, none of them threw that work away and began again. Agents & Dev Tooling 16 October 2026 The repository wrote the permission you clicked to stop being asked Planted files in a repository got Claude Code and Codex CLI agents to propose an attacker-useful "don't ask again" rule in 58% of attempts, during a routine request to set the project up and run it. Safety & AlignmentAgents & Dev Tooling 15 October 2026 Reviewers run the agent's tests more and believe them less Asked to compare human- and AI-authored pull requests, 239 practitioners ranked test inspection higher among where review time goes on the AI ones, and named tests as enough evidence to approve far less often. Agents & Dev Tooling 14 October 2026 Showing the model the warnings is what broke the code Given working files and a list of linter warnings to clear, the strongest models cleared almost all the warnings and left about a third of the files failing tests they had passed before. Agents & Dev Tooling 13 October 2026 The task got done and nobody asked for the rest of it Asked to finish a single function, coding agents also installed packages, ran git commands and wrote test files nobody requested. On one popular harness, more than half of the runs that only had to execute or test a function left the environment changed. Agents & Dev ToolingSafety & Alignment 9 October 2026 The stranger's pull request got read and the agent's didn't Across almost 27,000 merged pull requests, maintainers reviewed agent-authored changes less often than changes from outside contributors they had never met, including changes that edited the build pipeline. Agents & Dev Tooling 8 October 2026 The test it wrote will fail the day you fix the bug Researchers had an AI write regression tests for merged pull requests that carried a hidden bug. Up to one test in six passed only because the bug was there, and kept passing for the rest of the project's recorded history. Agents & Dev Tooling 7 October 2026 Parallel sub-agents made the work slower, not faster Across more than two thousand matched runs of three frontier coding agents, switching on parallel sub-agents raised token use and runtime, and on short, bounded tasks it lowered the success rate. Agents & Dev Tooling 6 October 2026 The risk was already handled. The agent handled it again. Agents were set tasks where the repository or the instruction had already settled how a risk should be treated. Depending on the setup, they guarded against it anyway in as many as three runs in five. Agents & Dev Tooling 5 October 2026 The fix was sitting there and nobody opened it Google ran an automatic repair agent on every failing pre-submit test across its codebase. Developers never opened four out of five of the fixes it posted. Agents & Dev Tooling 4 October 2026 The attacker fixed exactly what the reviewer asked for An attacker agent rewrote vulnerable pull requests using the AI reviewer's own rejection notes. One in five revisions won approval with a working exploit still live in the code. Safety & AlignmentAgents & Dev Tooling 2 October 2026 The detector that won the benchmark had already read it Fifteen prompt-injection detectors were measured on the tool outputs an agent actually screens, rather than on benchmark text. The one that tops the popular public benchmark caught 2% of the injections inside an agent. Safety & AlignmentModels & Releases 30 September 2026 The command was the one you approved and it still did something else A researcher approved one exact git command in a coding agent, and in almost half of runs a repository hook swept an unrelated file into the commit. The command the agent issued never changed. Safety & AlignmentAgents & Dev Tooling 29 September 2026 The speed-up got merged in an hour and nobody timed it Researchers rebuilt and re-ran a sample of agent-written performance fixes that maintainers had already merged. Nearly a third produced no speed-up at all, or ran slower than the code they replaced. Agents & Dev Tooling 28 September 2026 The agent read its own code and wrote it again anyway Coding agents opened almost all of the code they had written in earlier turns, then called less and less of it, leaving a second copy of the same logic in half the task chains by the end. Agents & Dev Tooling 28 September 2026 The error message said run a command, and the best model gave up When an error message only said what had gone wrong, agents fixed an expired login most of the time. Adding one line of advice written for a human developer cut that to under half. Agents & Dev Tooling 24 September 2026 The charge went through twice and the agent said it was done When a write timed out after quietly succeeding, agents often did the work a second time. In nine out of ten of those runs they closed the task reporting success. Agents & Dev Tooling 24 September 2026 The tests caught the bug. Nothing caught the explanation. In a codebase written entirely by AI, roughly one in four of the agent's replies to its user contained at least one factual error. Agents & Dev Tooling 22 September 2026 The agent came back to fix its own merge Merged pull requests written by coding agents attract a follow-up fix about 1.6 times as often as human ones in the same repositories, and when the fix arrives, the same agent usually writes it. Agents & Dev Tooling 22 September 2026 The C code became Rust and the memory bug came with it Four tools that rewrite C into Rust automatically were run over programs with known memory bugs. In more than 40% of the rewritten versions that compiled, the original bug was still there. Safety & AlignmentAgents & Dev Tooling 20 September 2026 Money was a float until the prompt said otherwise Five frontier models wrote the same backend tasks twice, once from the ticket alone and once behind a short list of what had to be true of the result. Every one of them made fewer of the named mistakes the second time. Agents & Dev Tooling 17 September 2026 The agent read one file and reported on all 240 Agents failed to open every file they were asked to review in about two thirds of runs, and most of those reports gave no sign of it. Agents & Dev Tooling 16 September 2026 Neither half of the request asked for a secret Coding-agent models that refused a request for credentials sent in one message handed the same credentials over when the request was split across two. Safety & Alignment 15 September 2026 The registry doubled and nobody stayed to read it Most listings in one public agent-skill registry carry instructions reaching for shell or network access, and four in five have never drawn a star or a comment. Safety & AlignmentAgents & Dev Tooling 14 September 2026 Half the patches fixed the bug and left a back door Researchers rewrote real bug reports to smuggle a security flaw into the fix being asked for. About half the time the repair agent produced a patch that passed the project's own test suite and carried the flaw. Safety & AlignmentAgents & Dev Tooling 13 September 2026 The tool returned nothing and the agent answered anyway When the tool reported an error, the agent never invented a value. When the same tool reported success while returning nothing usable, it invented one in close to half of cases. Agents & Dev Tooling 10 September 2026 The version range the agent reads isn't the one the installer uses Six frontier models answered ordinary dependency-version questions almost perfectly, then dropped to barely better than guessing on one short, documented rule. Handed the ecosystem's own resolver as a tool, all of them got essentially everything right. Agents & Dev Tooling 9 September 2026 The code was fine until the bug-fixer read it Turned loose on programs that already worked, a repair model broke correct code several times more often than it fixed broken code. Small surgical edits did more damage than whole-file rewrites. Agents & Dev Tooling 8 September 2026 The agent's tests agreed with the bug it missed Given the same set of real bugs, a repair agent fixed fewer of them when it wrote its own tests first than when it wrote no tests at all. Agents & Dev Tooling 7 September 2026 The signature was right there and the agent installed anyway Across nearly two thousand controlled installation trials, no coding assistant ran a single command to check a signature, an attestation or a bill of materials before installing the software. Safety & AlignmentAgents & Dev Tooling 3 September 2026 The agent never saw the command that ran A plugin update that changed no code, only configuration, got attacker-chosen commands running on the host in all seven AI coding harnesses tested. The model never reads those commands and never approves them. Safety & AlignmentAgents & Dev Tooling 3 September 2026 The one-line bug came back as sixty lines Asked to fix a one-line bug in working code, frontier models routinely rewrote far more of the function than the fix required. The oversized patches passed the tests anyway. Agents & Dev Tooling 2 September 2026 Remembering the requirement late undoes twice as much code In real coding-agent sessions, a requirement raised after the agent had already started writing was followed by roughly twice as much deletion of the agent's own earlier code as an ordinary edit. Agents & Dev Tooling 1 September 2026 The model fixed fewer bugs when told where to look In a controlled comparison, pointing a code model at the lines a failing test implicates produced fewer working fixes than simply asking it to write the whole solution over again. Agents & Dev Tooling 1 September 2026 The top search result was the version that doesn't work A new benchmark planted near-identical broken copies of working code in the search pool. The strongest code-search system put the version that actually runs at the top of the results about a third of the time. Agents & Dev Tooling 31 August 2026 The dependency upgrade stopped halfway through the repository Coding agents were handed hundreds of real dependency upgrades from open-source projects and asked to make the code work again. The best one managed about half, and its most common mistake was repairing part of the codebase and leaving the rest on the old version. Agents & Dev Tooling 28 August 2026 The five-line config is where the model does its worst work Someone finally ran human-written infrastructure code through the same scanners used to judge the machine-written kind. Matched for size, the generated templates were flagged around three and a half times as often. Safety & Alignment 26 August 2026 Nobody writes the rules file until the agent is already in the repo Projects with no AI configuration committed to version control saw code complexity climb about twice as fast after adopting coding agents, and almost none of the configured ones had written theirs before the agent arrived. Agents & Dev Tooling 25 August 2026 The model made the code safer by changing what you asked for Adding security instructions to a coding prompt barely changed how much flagged code came back. What it changed was how often the model replaced the risky construct the task had specifically asked for. Safety & AlignmentAgents & Dev Tooling 24 August 2026 Every test passed because nothing had been migrated Coding agents were set loose on twenty real open-source codebases and told to rebuild each one on a different technology stack. Some handed the repository back barely changed, and the original test suite gave them full marks. Agents & Dev ToolingModels & Releases 21 August 2026 Nobody asked for secure code, so nobody got it The same assistant built six web applications twice over, once from a plain specification and once with a paragraph of security requirements appended. Every serious flaw the study confirmed was in the plain version. Safety & AlignmentAgents & Dev Tooling 21 August 2026 One agent wrote the pull request, another reviewed it a minute later Across public GitHub, roughly 45,000 pull requests written by one vendor's coding agent were reviewed by a rival vendor's agent, usually within minutes of being opened. Agents & Dev Tooling 20 August 2026 Most of the improvement came from a broken answer key When an AI writes tests and a single existing program supplies the right answers, most of the apparent gain from refining those tests disappears once two more correct programs check the same work. Agents & Dev Tooling 18 August 2026 Everyone gets their own API key, and everyone shares one cache Researchers tested five widely used LLM gateways and found that none of them kept one customer's prompt cache out of another customer's reach by default. Safety & Alignment 18 August 2026 Rewrite the code, keep the meaning, and the leaderboard never notices Researchers rewrote real repositories into code that behaves identically, then set coding agents loose on both versions. Success rates barely moved. What the agents spent to get there did. Models & ReleasesAgents & Dev Tooling 17 August 2026 The manager agent never managed anything Teams of coding agents were told which one of them was in charge. Across nearly two thousand instrumented runs, the traffic never concentrated on that agent and success never reliably improved. Agents & Dev Tooling 14 August 2026 The agent stopped picking the right skill and finished anyway When researchers grew a coding agent's skill library to a hundred entries, it almost stopped opening the right skill for the job, and completed about as many tasks as before. Agents & Dev Tooling 13 August 2026 Nobody tells the agent what it already got right When an AI repair loop fixes one problem in your infrastructure code, it sometimes breaks a security control that was already passing. The way these loops report progress can't show it. Safety & AlignmentAgents & Dev Tooling 11 August 2026 Changing nothing but the interface made the agent half as expensive Six ways of handing a coding agent the same abilities produced the same success rate and very different reliability and cost. Agents & Dev Tooling 9 August 2026 Most public agent skills have routing or packaging defects A sweep of 138,000 shared skill files found nine in ten carry a defect. The commonest by far is a skill that never says when it should be used. Agents & Dev Tooling 9 August 2026 The same job, the same model, twenty times the tokens Researchers set out to settle the argument about how coding agents should reach their tools, and found the wrapper around the model moved token consumption twenty times further than the protocol did. Agents & Dev Tooling 6 August 2026 Coding agents recommend one language, then quietly write Python Asked which language suits a project, models name a sensible one. Asked to build the same project, a third of the time they reach for Python anyway, and mostly never notice they made a choice. Agents & Dev Tooling 6 August 2026 Nothing broke. The compute bill went up anyway. A year of production data from a company serving billions of users found AI-written C++ was slightly less likely to be rolled back than human code, and measurably more expensive to run. Agents & Dev ToolingInfrastructure & Compute 5 August 2026 The plateau was in the benchmark, not the models A widely trusted test of AI coding ability had been marking correct answers wrong for years. Fix it, and the models that looked stuck turn out to be close to acing it. Models & ReleasesAgents & Dev Tooling 4 August 2026 The worst AI policy is the one you never wrote down A study of nearly 30,000 open-source projects finds that written rules about AI-assisted contributions make AI use more visible rather than less, and that vague, unstated restrictions are the only approach that pushes it back into the dark. Policy & SocietyAgents & Dev Tooling 31 July 2026 Most agent tool servers have no front door A scan of live Model Context Protocol servers found the overwhelming majority open to anyone on the internet, and hundreds offering shell access with no credentials at all. Safety & AlignmentAgents & Dev Tooling 30 July 2026 Coding agents won't delete code. They wrap it in an if statement. Nearly a third of AI patches that pass their tests keep the very code the fix was meant to remove, tucked behind a newly added guard clause. Agents & Dev Tooling 28 July 2026 Small coding models retry better when they can't see their last attempt A controlled test of small, locally-run coding models finds that showing one its own failed code before asking for a fix makes the fix worse, not better, and burns more compute doing it. Agents & Dev Tooling 28 July 2026 The context file isn't making your agent better at the job A controlled test of AGENTS.md files across two coding agents found no change in whether the work got done, and one clear change in how it got done. Agents & Dev Tooling 27 July 2026 The first fifteen minutes decide whether AI code survives A new study of real developer edits finds AI-written code is rarely improved bit by bit. Developers keep it almost whole, or bin it, and they usually decide within the hour. Agents & Dev Tooling 26 July 2026 The proxy in front of your coding agent can rewrite what it executes Researchers tampered with the traffic passing through a router in front of four popular coding agents, and every one of them ran the fake commands anyway, no matter which safety mode was on. Safety & AlignmentAgents & Dev Tooling 24 July 2026 Developers trust Copilot's code review. They ignore almost everyone else's. The first large-scale study of how developers handle AI-generated review comments finds a wide trust gap between coding assistants, and pinpoints the one feature that actually gets a comment acted on. Agents & Dev Tooling 23 July 2026 Coding agents don't get better at your codebase the longer they're in it Merge rates for AI coding agents swing wildly by which agent filed the pull request, from under half of attempts accepted to more than 80%, but how long a team has used that agent explains almost none of it. Agents & Dev Tooling 21 July 2026 Your CI/CD agents will verify the exploit. They just won't stop it. A pipeline of AI agents waved through a secret-stealing code change in over half of worst-case runs, simply because the request claimed it had already been approved — even though the code itself looked completely ordinary. Safety & AlignmentAgents & Dev Tooling 20 July 2026 One bad memory is enough to make your coding assistant insecure A single insecure habit stored in a coding assistant's memory can make it write insecure code up to 50 points more often, and ordinary conversation won't undo it. Safety & AlignmentAgents & Dev Tooling 20 July 2026 Your coding agent is leaving junk behind. It has a name now. Researchers call it CodeSlop: the leftover speculative edits an agent never cleans up on its way to a passing test. A new technique cuts it by up to a third without touching the final diff. Agents & Dev Tooling