MOSAIC-Bench: Measuring Compositional Vulnerability Induction in Coding Agents

Name: MOSAIC-Bench: Measuring Compositional Vulnerability Induction in Coding Agents
Uploaded: 2026-10-04T05:55:12.687988+00:00
Duration: 488 s
Description: The research tested how production coding agents generate exploitable code when tasks are broken into multiple innocuous engineering tickets, finding high vulnerability rates (53–86%). This 'compositional gap' shows that staged tasks bypass single-prompt defenses. The key defense found was reframing the code reviewer as an adversarial pentester, which significantly reduced evasion.

The research tested how production coding agents generate exploitable code when tasks are broken into multiple innocuous engineering tickets, finding high vulnerability rates (53–86%). This 'compositional gap' shows that staged tasks bypass single-prompt defenses. The key defense found was reframing the code reviewer as an adversarial pentester, which significantly reduced evasion.

Open the full episode