Trust but Verify? Uncovering the Security Debt of Autonomous Coding Agents

The paper “Trust but Verify? Uncovering the Security Debt of Autonomous Coding Agents,” by researchers at the University of Texas at San Antonio and Danovo Energy Solutions, examines security smells introduced by autonomous coding systems including GitHub Copilot, OpenAI Codex, Claude Code, Cursor, and Devin. Using the AIDev dataset, the authors analyzed 16,112 added file changes across 4,022 pull requests, applying a six-category taxonomy grounded in OWASP guidance, Center for Internet Security benchmarks, and GitHub hardening practices. An LLM-as-a-judge pipeline based on quantized Qwen3.6-35B-A3B-FP8 and Google DeepMind’s Gemma-4-26B-A4B-IT-FP8 was validated against manual annotations. The central finding is that 38.9% of agent-generated pull requests contained at least one security smell. Supply-chain integrity problems, such as mutable action or container-image tags and unpinned installations, represented 82.3% of all detected smells, while hard-coded credentials accounted for 99.6% of critical-severity findings. Manual investigation confirmed 74 genuine credentials; human collaborators introduced 67.6% of them, compared with agents introducing the remainder, and reviewers or security bots failed to comment on 81.1% before integration. The judge achieved 0.836 F1 on the validation sample, but its 0.775 recall indicates that reported prevalence is likely an underestimate. The authors conclude that agent-generated code requires context-aware, point-of-collaboration guardrails rather than reliance on conventional review pipelines alone.