Natural Code Transformation Confuses Agents in Vulnerability Analysis
On the map: LLM agents and tool use → Agent threats, guardrails and governance also fits: Software engineering coding agents
Abstract (arXiv)
Having demonstrated a strong potential for automating vulnerability discovery, AI agents can also be used to attack software systems at scale. Today's software systems need mechanisms to level the playing field by slowing down potential attacks, giving them time to patch vulnerabilities and strengthen software. Along this line, our study of agent trajectories in vulnerability analysis shows a surprising finding: agents produce dramatically different results across real-world code commits that carry the same functionality and the same vulnerability. This phenomenon appears consistently in multiple code domains and vulnerability categories. It motivates us to study natural and functionality-preserving code transformations derived from real-world software development, and their potential as a defense against attacker agents. We build a corpus of natural transformations by mining recurring development patterns from real-world code commits, and apply them to evaluate impact on agentic vulnerability analysis. Our results show that even a single form of transformation can effectively "confuse" frontier agents, e.g., Codex with GPT-6 Sol, reducing successes in vulnerability discovery. We also study different agent failures, whether transformations can be composed to provide stronger protection, and adaptive attackers who seek to reverse them. Overall, our study of natural code transformation significantly expands the research space of using code transformations to defend against malicious agents.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 35 of its 52 references that are in the map. First posted on arXiv 9 Oct 2026.
Builds on
35 of 52 references.
Closest ancestors · 10
Same direction, newest first
- 2026ExploitBench: A Capability Ladder Benchmark for LLM Cybersecurity Agents13 May
- 2026ExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks?11 May
- 2026Program Analysis Guided LLM Agent for Proof-of-Concept Generation8 Apr
- 2026Capture the Flags: Family-Based Evaluation of Agentic LLMs via Semantics-Preserving Transformations5 Feb
- 2025SEC-bench: Automated Benchmarking of LLM Agents on Real-World Software Security Tasks13 Jun
- 2025BountyBench: Dollar Impact of AI Agent Attackers and Defenders on Real-World Cybersecurity Systems21 May
- 2025CVE-Bench: A Benchmark for AI Agents' Ability to Exploit Real-World Web Application Vulnerabilities21 Mar
- 2025Benchmarking LLMs and LLM-based Agents in Practical Vulnerability Detection for Code Repositories5 Mar
- 2024PentestAgent: Incorporating LLM Agents to Automated Penetration Testing7 Nov
- 2024Teams of LLM Agents can Exploit Zero-Day Vulnerabilities2 Jun
Other references · 25
- 2013Intriguing properties of neural networkscited by 5,155
- 2026GLM-5: from Vibe Coding to Agentic Engineeringcited by 587
- 2026SkillsBench: Benchmarking How Well Agent Skills Work Across Diverse Taskscited by 315
- 2023OctoPack: Instruction Tuning Code Large Language Modelscited by 189
- 2024SWT-Bench: Testing and Validating Real-World Bug-Fixes with Code Agentscited by 133
- 2026SoK: Agentic Skills -- Beyond Tool Use in LLM Agentscited by 130
- 2022ReCode: Robustness Evaluation of Code Generation Modelscited by 103
- 2024NYU CTF Bench: A Scalable Open-Source Benchmark Dataset for Evaluating LLMs in Offensive Securitycited by 93
- 2025CyberGym: Evaluating AI Agents' Real-World Cybersecurity Capabilities at Scalecited by 78
- 2026DeepSeek-V4.1-Flash: Pushing the Limits of KV Cache Compressioncited by 76
- 2019Adversarial Examples for Models of Codecited by 63
- 2025RepoAudit: An Autonomous LLM-Agent for Repository-Level Code Auditingcited by 49
13 more
- 2020Semantic Robustness of Models of Source Codecited by 45
- 2025Comparing AI Agents to Cybersecurity Professionals in Real-World Penetration Testingcited by 15
- 2022How Important are Good Method Names in Neural Code Generation? A Model Robustness Perspectivecited by 11
- 2023Exploiting Code Symmetries for Learning Program Semanticscited by 10
- 2025Locus: Agentic Predicate Synthesis for Directed Fuzzingcited by 9
- 2025LLMs Lean on Priors, Not Programming Language Semanticscited by 6
- 2025A Systematic Study of Code Obfuscation Against LLM-based Vulnerability Detectioncited by 5
- 2024On the Adversarial Robustness of Instruction-Tuned Large Language Models for Codecited by 3
- 2025Adversarial Attack Classification and Robustness Testing for Large Language Models for Codecited by 3
- 2026A Jagged Frontier: Evaluating Robustness of Code Agents to Semantics-Preserving Transformationscited by 2
- 2026PatchBench: Evaluating AI Agents for Vulnerability Patchingcited by 2
- 2025Auto-SPT: Automating Semantic Preserving Transformations for Codecited by 1
- 2026Symbolon: Symbolic Execution by Learning Code Transformationcited by 1
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2026Security in the Age of AI Teammates: An Empirical Study of Agentic Pull Requests on GitHub
- 2026Code-Augur: Agentic Vulnerability Detection via Specification Inference
- 2026Safer Builders, Risky Maintainers: A Comparative Study of Breaking Changes in Human vs Agentic PRs
- 2026Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale
- 2026Vulnerability Localization Benchmark: Measuring Agentic Security Analysis at Repository Scale
- 2025SecureVibeBench: Benchmarking Secure Vibe Coding of AI Agents via Reconstructing Vulnerability-Introducing Scenarios
- 2026MOSAIC-Bench: Measuring Compositional Vulnerability Induction in Coding Agents
- 2026What Do AI Agents Actually Change? An Empirical Taxonomy of Mutation Patterns in Performance-Improving Pull Requests