The attacker has control over an incoming code patch or pull request and makes a harmful modification resemble a genuine maintenance fix. Reviewers are asked to inspect the diff, but context that appears routine can obscure the side-effect path. The authors constructed 1,088 valid controlled attacks and found three agentic reviewers detected about 85% to…
Inspect the ClaimsCase · DiggingBeagle record
Malicious maintenance-looking patches survived automated AI code review
CyberDual embeds attack-bearing changes among realistic maintenance material and measures whether AI reviewers identify the actual exploit path.
Scope
The benchmark is a controlled software review environment, not proof that those patches reached releases or caused live breaches.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- not applicable
- AI role
- AGAINST AI
Basis and provenance
The 1,088 valid malicious-patch attempts are graded by their executable effects and review outcomes inside controlled repositories. This demonstrates review bypass under a benchmark, not insertion into real released projects or customer systems. Impact is left ungraded because a calibrated 0-to-4 impact basis for actual affected targets is unavailable from these Claims.
Assessed Oct 28, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP22-023-A · CLM-CP22-023-B · CyberDual: AI Attackers versus AI Code Reviewers in Software Maintenance
At a glance
Performance under repository-specific policy tests and multi-reviewer escalation is not established.
Limits and uncertaintyFull account
The attacker has control over an incoming code patch or pull request and makes a harmful modification resemble a genuine maintenance fix. Reviewers are asked to inspect the diff, but context that appears routine can obscure the side-effect path.
The authors constructed 1,088 valid controlled attacks and found three agentic reviewers detected about 85% to 91% under their evaluation settings. The paper reports that roughly one in six maintenance-context attacks evaded particular reviewed configurations, distinct from code compromise in production repositories. Primary evidence.
The benchmark is a controlled software review environment, not proof that those patches reached releases or caused live breaches.
Run semantic security invariants and exploit reproductions against the resulting executable code, not only an LLM diff explanation.
Claims & evidence
CLM-CP22-023-AThe authors constructed 1,088 valid controlled attacks and found three agentic reviewers detected about 85% to 91% under their evaluation settings.supported
Basis: reported finding
- supportsCyberDual: AI Attackers versus AI Code Reviewers in Software Maintenanceprimary disclosure
Abstract; Section 3 Results
CLM-CP22-023-BThe paper reports that roughly one in six maintenance-context attacks evaded particular reviewed configurations, distinct from code compromise in production repositories.supported
Basis: reported finding
- supportsCyberDual: AI Attackers versus AI Code Reviewers in Software Maintenanceprimary disclosure
Section 3.1, 3.2; maintenance-window attack results
Controls and mitigations
- Run semantic security invariants and exploit reproductions against the resulting executable code, not only an LLM diff explanation.
Unknowns and contradictions
- Performance under repository-specific policy tests and multi-reviewer escalation is not established.
Sources and citation
Material revision history
- Oct 28, 2026 · Canonical change recorded · new in release · revision 199