Newest papers

Secure Agentic Coding through Counterexample-Grounded Feedback

Tue Le, Anh Nguyen Hoang, Gabriel Sasseville, Doseok Jang, Pierre‐Luc Bacon, Nghi D. Q. Bui · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.25916 · cited by 0 works (OpenAlex) · open-access PDF

Spanish

A medida que los modelos de codificación y los armarios de agentes se vuelven más capaces, la verificación de seguridad confiable se está convirtiendo en un obstáculo central. La mejora de la generación de código seguro requiere un mensaje cuyo progreso reportado permanece alineado con el comportamiento real del programa bajo optimización; de lo contrario, un optimizador puede mejorar el veredicto del mensaje sin eliminar la vulnerabilidad subyacente. Los enfoques basados en modelos existentes requieren modelos para inferir el comportamiento del programa desde el código fuente o especificar los resultados correctos para las pruebas adversarias, colocando demandas de razonamiento sustancial sobre el mensaje de seguridad. Introducimos \falcon{}, un marco de verificación basado en contraejemplo que separa la exploración de ataque de la verificación de comportamiento y los

Machine translation (Meta M2M100); the English original follows.

Abstract

As coding models and agent harnesses become more capable, reliable security verification is becoming a central bottleneck. Improving secure code generation requires a signal whose reported progress remains aligned with actual program behavior under optimization; otherwise, an optimizer can improve the signal's verdict without removing the underlying vulnerability. Existing model-based approaches require models to either infer program behavior from source code or specify correct outcomes for adversarial tests, placing substantial reasoning demands on the security signal. We introduce \falcon{}, a counterexample-grounded verification framework that separates attack exploration from behavioral verification and connects them through execution traces of the program under test. In test-time repair, \falcon{} yields substantially stronger held-out functional-security gains than alternative security signals across secure code generation benchmarks, while preserving or improving functionality. As an RL reward, \falcon{} also outperforms static-analysis and learned rewards on held-out functional-security, even when all policies successfully optimize their respective training rewards. Combining \falcon{} with either proxy reward further improves held-out performance, suggesting that execution-grounded feedback can mitigate reward overoptimization while preserving useful guidance from existing security signals.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, Adversarial system, Coding (social sciences), Source code, Code (set theory), Computer security

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange