Search arXiv⌕ Search
Home/Archive/arXiv

arXiv · 2610.34435

CyberDual: AI Attackers versus AI Code Reviewers in Real Software Maintenance

Chenyuan Yang·Hwiwon Lee·Jongseong Kim·Yihan Yang·Dongjun Kim·Yinfang Chen·Lingming Zhang
View original source ↗Read source document ↗Export metadata ↓

Abstract

Open-source projects now let AI agents review incoming code, but the code under review may itself come from an AI attacker. We present CyberDual, an arena for this dual role of AI: attacker agents hide an exploitable bug in real maintenance work on widely used open-source projects, and reviewer agents try to find and repair it. Execution decides each match: we rerun the attacker's proof of concept (PoC) on the code that comes out of review. Every attack is new, and the windows can be rebuilt each quarter from the latest upstream history. Three agentic reviewers catch 85-91% of 1,088 valid attacks from six attackers. Yet when the attacker spreads the bug over real upstream commits, about one in six attack slots still ends with a working exploit after review. The strongest attacker has open weights: GLM 5.3 almost never refuses, and its attacks make up 13 of the 28 that get past all three reviewers. When they miss, Claude reviewers mostly approve the attack, while GPT-6-Sol mostly repairs the wrong code; a reviewer from a second vendor catches about two thirds of a Claude reviewer's misses. Beyond a leaderboard, CyberDual has three uses. First, PoC execution gives both sides a reward that agent reports cannot game, so its surviving attacks can train reviewers against stronger attackers. Second, it can gate a release on both scores: Claude Sonnet 5 refuses one in five attack slots, yet attacks about as well as GPT-6-Sol, so refusal alone does not remove attack capability. Third, it can warn the teams behind a deployed reviewer when a new attacker crosses a threshold: GLM 5.3 in Claude Code already gets an exploit past Sonnet 5 in 17% of its attack slots.

Explore related subjects

cs.CRcs.AIcs.SE

Keep this discovery

Explore connections, maps & timelines

BibTeXRIS

Chenyuan Yang, Hwiwon Lee, Jongseong Kim, Yihan Yang, Dongjun Kim, Yinfang Chen, Lingming Zhang. 2026-10-25. CyberDual: AI Attackers versus AI Code Reviewers in Real Software Maintenance. https://arxiv.org/abs/2610.34435

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

What's in a Package? Getting Visibility Into Dependencies Using Security-Sensitive API Calls

The Log4Shell vulnerability occurred because the JNDI (Java Naming and Directory Interface) lookup feature was used, even though it was not needed for log4j's core functionality. This case illustrates why developers may want visibility into the sensitive capabilities available through a dependency. The presence of a call alone does not establish that the call is unnecessary or risky. Security-sensitive APIs provide access to security-sensitive resources, such as filesystem, network, or process-related resources. If developers know which types of sensitive resources a dependency can access, they can control their dependencies at a finer grain, and they can consider an alternative dependency when a dependency makes unnecessary or suspicious security-sensitive API calls. However, prior work has not provided a documented, repeatable procedure for deriving an ecosystem-specific security-sensitive API list, so developers lack systematic visibility into the sensitive capabilities of their dependencies. The goal of this study is to aid developers in understanding sensitive resources accessible to their dependencies by identifying security-sensitive APIs in packages through an empirical study of Java packages. In this study, we present a novel and repeatable methodology to construct a security-sensitive API list for an ecosystem, and we apply it to Java. We then compare the security-sensitive API calls of functionally similar Java packages. The number of security-sensitive API calls (call level) ranges from 0 to 368 in one capability and from 0 to 429 in total among packages with similar functionality. These packages also differ in capability breadth, the number of the 15 capabilities that a package reaches. For example, capability breadth ranges from 0 to 10 in the "Dependency Injection" category and from 0 to 13 in the "Web Frameworks" category.

cs.CR↗
arXiv2026

WADBERT: Dual-Channel Web Attack Detection via Permutation-Invariant Parameter Modeling

Web attack detection is the first line of defense for securing web applications, designed to preemptively identify malicious activities. Deep learning-based approaches are increasingly popular for their advantages: automatically learning complex patterns and extracting semantic features from HTTP requests to achieve superior detection performance. However, existing methods are less effective at representing irregular HTTP requests and introduce unnecessary sensitivity to payload parameter order. To tackle this issue, in this paper, we propose WADBERT, a structure-aware dual-channel framework for web attack detection built on two complementary designs. First, we introduce \textit{Hybrid Granularity Embedding (HGE)}, which combines WordPiece embeddings with token-aligned character representations to capture fine-grained patterns in symbol-dense URLs and payload parameters. Second, we develop \textit{structure-aware feature extraction}, with separate branches for the sequential URL and the unordered collection of payload parameters. Each parameter is encoded independently, and position-free multi-head attention followed by mean pooling produces a payload representation invariant to parameter reordering. The URL and payload features are fused for request classification, while the learned parameter-level attention weights support inspection of potentially malicious parameters. Experiments on CSIC2010 and SR-BH2020 validate the effectiveness of our method: WADBERT achieves F1-scores of 99.64\% and 99.59\%, respectively, outperforming the evaluated state-of-the-art baselines.

cs.CR↗
arXiv2026

A Cross-Modal Prompt Injection Attack against Large Vision-Language Models with Image-Only Perturbation

Large vision-language models (LVLMs) have emerged as a powerful paradigm for multimodal intelligence, but their growing deployment also expands the attack surface of prompt injection. Despite this growing concern, existing attacks still suffer from a critical limitation: the injected prompt for one modality only steers the model's interpretation of that singular input. Alternatively, these attacks remain multimodal but fail to achieve cross-modal prompt perturbation. To bridge this gap, we introduce a novel cross-modal prompt injection attack CrossMPI, which can steer the model's interpretation of both textual and visual inputs via image-only prompt injection. Our design is underpinned by the following key breakthroughs. First, we turn the focus of the injected prompt perturbation optimization from the visual embedding space (typically with only $10^5$ parameters) to the model hidden state space (for multimodal information integration and with $10^7$ parameters). Then, two strategies are adopted to mitigate the optimization challenges posed by the larger parameter space. To constrain the optimized model parameter space, we introduce a layer selection strategy that identifies the layers most critical to multimodal integration. Interestingly, deviating from the past experience, our analysis reveals that the optimal layers for LVLM prompt perturbation reside in the middle of the model rather than the last. To constrain the image perturbation space, we propose a new distance-decremental perturbation budget assignment strategy that allocates budgets decrementally as the pixel distance to semantic-critical regions increases. Extensive experiments across multiple LVLMs and datasets show that our method significantly outperforms baseline approaches.

cs.CR↗