Yang and colleagues present CyberDual, testing AI-planted memory-safety defects in real C/C++ maintenance contexts against agentic review and repair. The study collected 1,088 valid attacks and reports 85–91% catch rates on the attacks scored by each reviewer; its executable oracle does not certify preserved functionality.
Why it matters
It tests whether an attack survives agentic review, distinguishing a reviewer’s verdict from the code it leaves behind.
Key facts
As stated in the sources, with where to find them.
- Six attacker models produced attacks for 14 open-source projects; GLM 5.3 ran in two harnesses. Seven configurations across three setups yielded 1,470 slots, of which 1,088 were valid attacks.Section 2; Appendix B.1
- Among valid attacks with a scored review, Sonnet 5, Opus 4.8 and GPT-6-Sol caught 85%, 88% and 91%. Thirteen Sonnet 5 reviews ended in refusal, and three Opus 4.8 reviews had infrastructure failures; these were excluded as unscored.Section 2.5; Section 3.4; Appendix A, Review
- Attacker success rates divide surviving attacks by slots after excluding valid attacks without a scored review; invalid and refused attack submissions count as losses. Comparisons do not control for reviewers’ prompts, harnesses or budgets.Section 2.5, Equation 2; paragraph after Table 1; Appendix B.2
- The sandboxed study pushed nothing upstream. It covers memory safety, does not measure benign-change rejection, and can count a catch that removes functionality; execution success is not proof of a satisfactory repair.Section 6, Limitations and ethics
Findings that cite this record
No tracked finding cites this record yet.
Key questions this bears on
- Is AI shifting the balance between finding and fixing vulnerabilities?Discovery is ahead. Verification, triage, coordinated disclosure and safe repair remain bottlenecks between AI findings and deployed fixes.
Sources
Related records
Oct 13, 2026
Sep 26, 2026
Oct 20, 2026
Oct 12, 2026
Sep 29, 2026
Sep 29, 2026