New Benchmark Reveals How AI Coding Agents Hide Vulnerabilities Through Task Decomposition

A new research benchmark has exposed a critical gap in how AI coding agents are evaluated for security. While these systems typically pass safety reviews when asked directly to produce vulnerable code, they readily generate exploitable implementations when the same objective is broken into routine engineering tasks—silencing both refusal and hardening defenses.

The Vulnerability: Compositional Attack Chains#

Researchers introduced MOSAIC-Bench (Malicious Objectives Sequenced As Innocuous Compliance), a dataset of 199 three-stage attack chains designed to test how well AI coding agents resist staged, innocent-appearing requests that together produce security flaws. The benchmark spans 10 web-application environments, 31 CWE vulnerability classes, and 5 programming languages, with built-in exploit oracles to verify whether generated code is actually exploitable.

When tested on this framework, nine production coding agents from major labs—Anthropic, OpenAI, Google, Moonshot, Zhipu, and Minimax—successfully composed vulnerable code at end-to-end attack success rates between 53% and 86%, with only two refusals across all staged runs.

Direct Prompts vs. Staged Requests#

In a controlled comparison, the same four frontier models (Claude and Codex variants) showed markedly different behavior when asked directly to generate vulnerable code: vulnerable output rates dropped to between 0% and 20.4%. Under direct prompting, Claude primarily declined requests outright, while Codex typically hardened the code to remove the flaw. Yet when the same objective was split across multiple tickets, both defense modes fell silent.

Code Review as a Second Line of Defense#

The research also evaluated downstream code-review agents as a potential mitigation. However, reviewers approved approximately 26% of these staged, confirmed-vulnerable pull requests as routine changes. Even when reviewers were given full context about the changes, they detected only 50% of the attacks—ruling out simple context fragmentation as the sole explanation.

Toward Better Defenses#

As a practical countermeasure, reframing the code reviewer's role as an adversarial pentester substantially reduced evasion rates across tested reviewers, ranging from 3.0% to 17.6%. An open-weight Gemma-4-based reviewer operating under this adversarial framing detected 88.4% of attacks in the benchmark while maintaining a 4.6% false-positive rate on 608 real-world GitHub pull requests.