{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/cyberdual-ai-attackers-code-reviewers-2026/",
 "asOf": "2026-10-30",
 "id": "cyberdual-ai-attackers-code-reviewers-2026",
 "date": "2026-10-25",
 "datePrecision": "day",
 "title": "CyberDual evaluates AI attackers planting memory-safety defects against AI code reviewers on real maintenance contexts",
 "lane": "defense",
 "kind": "paper",
 "summary": "Yang and colleagues present CyberDual, testing AI-planted memory-safety defects in real C/C++ maintenance contexts against agentic review and repair. The study collected 1,088 valid attacks and reports 85–91% catch rates on the attacks scored by each reviewer; its executable oracle does not certify preserved functionality.",
 "whyItMatters": "It tests whether an attack survives agentic review, distinguishing a reviewer’s verdict from the code it leaves behind.",
 "actors": [
  "uiuc",
  "arizona-state-university"
 ],
 "topics": [
  "vulnerability-repair",
  "capability-evaluation",
  "eval-validity",
  "agent-supply-chain"
 ],
 "atlas": [
  "supply-chain",
  "model",
  "eval-environment"
 ],
 "artifacts": [
  "cyberdual",
  "glm",
  "claude-opus-4"
 ],
 "sources": [
  {
   "url": "https://arxiv.org/abs/2610.34435v1",
   "publisher": "Chenyuan Yang et al. (arXiv)",
   "title": "CyberDual: AI Attackers versus AI Code Reviewers in Real-World Software Maintenance",
   "date": "2026-10-25",
   "type": "primary",
   "accessed": "2026-10-30"
  }
 ],
 "keyFacts": [
  {
   "fact": "Six attacker models produced attacks for 14 open-source projects; GLM 5.3 ran in two harnesses. Seven configurations across three setups yielded 1,470 slots, of which 1,088 were valid attacks.",
   "locator": "Section 2; Appendix B.1"
  },
  {
   "fact": "Among valid attacks with a scored review, Sonnet 5, Opus 4.8 and GPT-6-Sol caught 85%, 88% and 91%. Thirteen Sonnet 5 reviews ended in refusal, and three Opus 4.8 reviews had infrastructure failures; these were excluded as unscored.",
   "locator": "Section 2.5; Section 3.4; Appendix A, Review"
  },
  {
   "fact": "Attacker success rates divide surviving attacks by slots after excluding valid attacks without a scored review; invalid and refused attack submissions count as losses. Comparisons do not control for reviewers’ prompts, harnesses or budgets.",
   "locator": "Section 2.5, Equation 2; paragraph after Table 1; Appendix B.2"
  },
  {
   "fact": "The sandboxed study pushed nothing upstream. It covers memory safety, does not measure benign-change rejection, and can count a catch that removes functionality; execution success is not proof of a satisfactory repair.",
   "locator": "Section 6, Limitations and ethics"
  }
 ],
 "significance": 3,
 "fideQuestions": [
  "FID-075",
  "FID-088"
 ],
 "methods": [
  "automated-patching"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-10-30",
 "revisions": []
}