CORTEXA
← Browse
arxivcs.AIcs.CRcs.SE2026-07-02

Steerability via constraints: a substrate for scalable oversight of coding agents

Thomas Winninger

Coding agents are capable; human oversight is the bottleneck. Unconstrained agents introduce security risks, erode codebase scalability, and make human review increasingly costly. We argue that the same methods used for decades to manage large human engineering teams: access control, network policies, strict coding conventions enforced by tooling; transfer directly to coding agents, and are cheaper (in token) than recent agentic scaffolding. We sketch a start-to-end system on this principle, and report a controlled experiment in scalable oversight: a small reviewer (Gemma 4 e4b) inspects a Python codebase containing 11 inserted backdoors. Recall rises from 54.5% (unconstrained, no tools) to 90.9% (constrained substrate plus a ~200-LoC `docs` CLI), with substrate and tools contributing independently. We choose Python deliberately: substrate-level oversight gains are largest where the language gives the fewest guarantees by default; the principles extend to languages like Rust.

View free PDFSource page

Related papers

arxivcs.CRcs.AIcs.SE2026-07-22

IssueTrojanBench: Benchmarking AI Coding Agents Against Malicious Issue Requests

Ankur Singh, Jinqiu Yang, Tse-Hsun Chen

AI coding agents powered by LLMs are increasingly integrated into real-world software development, where they generate, edit, and execute code with autonomous access to local files and tools. Coding agents inherit security risks from both the LLM backbone, where adversarial promp…

View free PDFSource page
arxivcs.SEcs.AIcs.CR2026-06-25

A Deterministic Control Plane for LLM Coding Agents

Padmaraj Madatha

LLM coding harnesses grant agents broad file and shell access, yet the configuration layer that steers them -- rules files, agent definitions, IDE-specific markdown -- is largely unmanaged. A prevalence study of 10,008 public GitHub repositories (n=6,145 agent config files) finds…

View free PDFSource page
arxivcs.SEcs.AIcs.CR2026-07-13

AutoTrace: From Patches to Triggers via Agentic Interprocedural Exploration

Arastoo Zibaeirad, Marco Vieira, Thomas Zimmermann

Given a vulnerability-fixing commit, trigger localization asks which specific statement turns the vulnerable program state into a concrete unsafe operation. This question is harder than binary vulnerability detection because the answer demands interprocedural, causal reasoning: i…

View free PDFSource page
arxivcs.CRcs.AIcs.SE2026-07-07

Unicode TAG-Block Concealment of Tool-Metadata Payloads in the Model Context Protocol: An Approval-View Fidelity Gap Across Three Independent Server Implementations

Mohammadreza Rashidi

The Model Context Protocol (MCP) is the dominant way coding agents discover and invoke external tools. A server advertises each tool through a tools/list handshake that returns a name, a natural-language description, and a JSON input schema. The client renders this metadata once,…

View free PDFSource page
arxivcs.CRcs.AIcs.SE2026-07-03

Builder, Defender, Breaker: The Case Against Removing the Human from the AI-Driven Security Lifecycle

Mohamed Chahine Ghanem

Artificial intelligence has spread across the whole of the security lifecycle. The same family of models now writes application code, hardens it, and probes it for weaknesses, so that a single generative substrate increasingly performs all three roles at once. Enthusiasm for this…

View free PDFSource page