Coding agents need safer inputs, guarded tools, and repeatable production paths

A defensive agent can become the execution path for malicious code when it reads an untrusted repository in an auto-approved mode. The reported proof of concept placed ordinary-looking project guidance and a security script inside a modified geopy repository. Claude Code and Codex inspected the files, accepted the script as safe, and ran a malicious binary. The authors report remote code execution across several Claude Code CLI versions and Codex CLI 0.142.4.

Model Context Protocol (MCP) servers show a related tool-safety problem. SpellSmith addresses taint-style attacks by adding security-aware instructions to tool descriptions and making the model reflect before final tool use. Its survey found 43 taint-style cases among 53 MCP vulnerability reports, while existing tool metadata rarely included security guidance. On 792 malicious prompts, the reported attack success rate was 0.13%.

The production work treats successful agent runs as material for future automation. Progressive crystallization extracts tool order, branch conditions, schemas, dependencies, parameters, and approval gates from verified incident-handling traces. Repeated success promotes a run into a hybrid playbook, then into deterministic execution after stronger consistency and review checks.

In the reported cloud network operations deployment, deterministic executions reached about 45% after eight months. The final execution mix was about 45% deterministic, 30% hybrid, and 25% fully agent-orchestrated. Per-incident agent cost fell by more than 70% while incident volume roughly doubled, and mean time to resolution fell from hours to minutes.

Agent repair outcomes depend on the structure and evidence inside the starting issue. In 433 SWE-bench Verified issues attempted by 87 agents, fix suggestions had the strongest positive association with success, with odds ratio 3.61. Repository source code, reproduction scripts, and naming the eventual patch file also helped. Longer reports correlated with lower repair odds.

Benchmark quality is a separate bottleneck for code performance claims. A re-test of 1,538 tasks from EffiBench, Enamel, EvalPerf, and Mercury found that only 94 benchmark-provided performant implementations were significantly faster on the original tests. A multi-agent test-generation setup exposed additional significant improvements in about a quarter of previously non-significant tasks, showing that many tests were too weak to measure runtime gains.

Generated software can change when the model receives demographic cues about the developer. One study generated 800 websites with ChatGPT-4.1 and DeepSeek-V3.2 while varying only persona name and age across gender and age groups. The effects appeared in interface design, template content, and code structure.

In the manually reviewed personal websites, photo galleries appeared only for older personas. Contact sections were more common for older personas, and among younger personas they were more common for young men than young women. Color choices also tracked persona groups: dark blue was mostly assigned to men, while pink and purple appeared only for women in the reviewed sample. The result is relevant for coding assistants that personalize output through account history or inferred user traits.