Agents on the Patch Path: Mining AI-Associated Security Remediation in GitHub Security Advisories
[Inżynieria oprogramowania] Autorzy: Claudio Segal, Paulo Segal, Hudson Silva Borges i 8 więcej
Autonomous coding agents are increasingly involved in software development, but their participation in real-world security remediation remains poorly understood. We investigate observable evidence of coding-agent involvement in commits referenced by reviewed GitHub Security Advisories (GHSAs), characterize the associated vulnerabilities, and examine review timing in relation to advisory disclosure routes. We develop a local-Git mining pipeline that identifies agent evidence through known agent accounts, explicit commit-message attribution, repository instruction files, and agent configuration artifacts. Linking these findings to GHSA-referenced commits yields 469 valid candidate advisories across 189 repositories, including 448 with direct attribution and 21 supported only by repository-level evidence. Claude is the most frequently observed tool family, followed by Copilot and Cursor. W…
- Kategoria arxiv
- cs.SE
- Kategoria
- Inżynieria oprogramowania