AI coding tools started with a fairly narrow promise: help developers write software faster. Early systems completed functions, suggested syntax, generated tests, and explained unfamiliar code. That framing is already becoming outdated. Modern coding agents can inspect entire repositories, execute commands, interact with development tools, test their own output, search external information, maintain context across many steps, and revise a plan after something fails. In security work, those capabilities change the role of the model from code generator to operational component.
That distinction matters. A system that produces a Python function from a prompt is a productivity tool. A system that can inspect an application, identify an authentication flaw, produce test code, execute that code, observe the result, revise its approach, and continue working has many of the properties of security infrastructure. The same workflow can support vulnerability research, secure code review, penetration testing, exploit development, malware engineering, or an intrusion. The technical capability is often nearly identical. Authorization and intent determine which side of the line it serves.
Recent academic research and threat intelligence suggest that this transition is already underway.
The Warning Started With the Code Itself
Security concerns around AI coding did not begin with autonomous agents. Researchers were identifying problems when the technology was still largely based on code completion.
In Asleep at the Keyboard? Assessing the Security of GitHub Copilot’s Code Contributions, Hammond Pearce and colleagues evaluated 1,689 programs generated across 89 scenarios involving security-relevant Common Weakness Enumerations. Approximately 40 percent of the generated programs contained vulnerabilities. The study was conducted using an early version of GitHub Copilot, so its percentage should not be applied directly to current systems. Its significance is more fundamental: code models could reproduce insecure development patterns at scale, even when their output appeared functional. The paper was later published at the 2022 IEEE Symposium on Security and Privacy.
The security issue has changed since then. Modern coding agents are no longer limited to producing the code that creates a vulnerability. They can also reason about code that already contains one.
Meta’s CyberSecEval research documented this progression. The original CyberSecEval benchmark examined both insecure code generation and model compliance with requests related to cyberattacks. CyberSecEval 2 extended the work into prompt injection, code-interpreter abuse, and vulnerability exploitation. The researchers found that coding-capable models performed better on exploitation tasks than models without comparable coding ability, though exploit generation remained inconsistent in their tests. They also found successful prompt-injection rates across tested models, showing that controlling an agent through behavioral restrictions remains a separate technical problem from improving the model itself.
This distinction is central to the dual-use problem. Better code reasoning helps a model recognize a vulnerable authentication check just as it helps the model recognize how to correct it.
From Writing Exploits to Running Them
Research from the University of Illinois Urbana-Champaign provided an early demonstration of what happens once code reasoning is combined with agency and tools.
In 2024, Richard Fang and colleagues reported that an LLM agent could autonomously perform web exploitation tasks that included SQL injection and blind database schema extraction. Their agent could interact with targets, reason about results, and continue without requiring a human to provide each command. The researchers also reported instances in which the agent identified vulnerabilities without receiving the vulnerability in advance.
A second study tested exploitation of 15 disclosed real-world vulnerabilities. When given CVE descriptions, the GPT-4-based agent successfully exploited 87 percent of the study’s vulnerabilities. Without the descriptions, the success rate fell to 7 percent. The sample was small and the result should not be read as an 87 percent success rate against arbitrary software. What the experiment demonstrated is still significant: once a vulnerability description becomes public, an AI agent can potentially turn disclosure information into working exploitation much faster than a human conducting every step manually.
That has direct implications for vulnerability-management timelines. Defenders have long dealt with the gap between disclosure and mass exploitation. AI coding agents can automate parts of the work that fill that gap: interpreting a CVE, locating affected code, adapting a proof of concept, troubleshooting errors, testing versions, and generating variants.
The next research step removed an even larger assumption.
A multi-agent system called HPTSA separated exploitation into planning and specialized agent roles. Instead of asking one model to maintain a long sequence of exploration, reasoning, and execution, a planning agent delegated work to agents focused on particular vulnerability classes. A peer-reviewed version published at EACL 2026 evaluated the approach against 14 real-world vulnerabilities and reported an improvement of up to 4.3 times over earlier agent frameworks.
The architectural lesson may matter more than the benchmark score. The gains did not depend solely on producing a dramatically smarter model. They came from organizing models into an operational system.
That is exactly what modern coding-agent platforms are doing.
The Threat Has Left the Lab
Academic demonstrations become more significant when similar patterns begin appearing in incident data.
In May 2026, Google Threat Intelligence Group reported what it described as a transition from early experimentation with generative AI to broader use inside adversary workflows. GTIG said it had identified a criminal threat actor using a zero-day exploit that Google assessed with high confidence had been developed with AI assistance. The exploit targeted a two-factor-authentication logic flaw in a widely deployed open-source web administration product. Google coordinated disclosure with the vendor before the planned mass-exploitation campaign occurred.
The flaw is interesting from an AI perspective. GTIG described it as a semantic logic error rather than a conventional memory-corruption or input-sanitization bug. Two parts of the application made contradictory assumptions about authentication. Traditional fuzzing or static rules can have trouble with bugs of this type since each code path may appear valid in isolation. A model capable of reasoning across the application can compare the developer’s apparent intent against what the code actually permits.
Google also reported state-linked actors experimenting with AI-supported vulnerability research. GTIG observed the North Korea-linked APT45 sending thousands of repetitive prompts to analyze CVEs and validate proof-of-concept exploits. Other actors tested specialized vulnerability datasets, coding-agent skills, and agentic penetration-testing frameworks. In several cases, the role of the AI was less about inventing a new hacking technique and more about removing manual work from an existing research process.
That distinction deserves attention. The immediate security effect of AI may come less from entirely new attack classes than from changing the economics of existing ones.
A skilled researcher can already read a patch, inspect source code, reproduce a vulnerability, write a scanner, develop a proof of concept, and test it against multiple configurations. Those activities cost time. If an agent can perform substantial portions of that workflow concurrently across hundreds or thousands of targets, the human bottleneck gets smaller.
Coding Agents Can Become Operators
The strongest evidence for the infrastructure argument comes from cases where the coding agent did more than produce software.
Anthropic reported in August 2025 that it had disrupted a cybercriminal operation in which Claude Code was used during data theft and extortion attacks against at least 17 organizations. According to Anthropic, the system assisted with reconnaissance, credential collection, network penetration, stolen-data analysis, and decisions about which information should be taken. The company separately reported a criminal using Claude to create ransomware products despite lacking the technical skill to implement key components independently.
A later case moved further into autonomous operations. In November 2025, Anthropic reported disrupting a cyber-espionage campaign in which a threat actor built an attack framework around Claude Code. According to the company’s telemetry, the AI performed an estimated 80 to 90 percent of campaign activity, with humans intervening at several major decision points. The model conducted reconnaissance, identified and tested vulnerabilities, generated exploit code, collected credentials, identified high-privilege accounts, organized stolen information, and produced documentation for subsequent operations.
These numbers come from the model provider’s own investigation, so they are best treated as provider-reported findings rather than a neutral measurement of all threat activity. The architecture described in the report is still revealing. The operator was no longer asking a chatbot how to perform an attack. The operator had placed an AI coding system inside an attack framework.
Coding, tool execution, planning, context retention, and feedback loops had become parts of one system.
That is infrastructure.
Defenders Get the Same Capability
There is a reason the dual-use label matters. Removing this technology from defensive security would also remove capabilities that are starting to produce measurable results.
Google Project Zero’s Project Naptime was built around a workflow similar to that of a human vulnerability researcher. The agent received a code browser, debugger, Python environment, and other tools that allowed it to inspect software, form hypotheses, execute tests, and verify results. The goal was not simply to ask a language model whether some code looked vulnerable. The system gave the model the means to prove or reject its own theories.
That project later became Big Sleep through collaboration between Project Zero and Google DeepMind. Big Sleep found a previously unknown exploitable memory-safety issue in SQLite before the affected code reached a production release. Google described it as the first public example of an AI agent finding a previously unknown exploitable memory-safety flaw in widely used real-world software.
DARPA’s AI Cyber Challenge showed the same principle at a much larger software scale. During the 2025 final competition, autonomous cyber reasoning systems analyzed more than 54 million lines of code. Across the competition, systems discovered 54 of 63 synthetic vulnerabilities and produced patches for 43. They also discovered 18 previously unknown non-synthetic vulnerabilities in real software and submitted 11 patches for those flaws.
Attack and defense are converging on the same technical workflow: find code, infer intent, locate anomalous behavior, construct a test, execute it, analyze the response, and generate new code.
One workflow calls the resulting program a proof of concept. Another calls it a regression test. A third converts the finding into a patch.
The Security Boundary Is Moving Into the Coding Agent
This changes how enterprises need to think about AI development tools.
An agent that can read a repository may gain access to proprietary source code. An agent that can execute commands has a path into the development workstation or CI environment. An agent connected to GitHub, cloud consoles, ticketing systems, package registries, or Model Context Protocol servers may inherit access far beyond the editor. An agent allowed to commit code can alter software. An agent permitted to run deployment tooling can turn generated code into an operational change.
The security question is no longer limited to whether the model occasionally suggests insecure code. Teams need to treat the surrounding agent runtime as part of the security boundary.
Identity, least privilege, command authorization, secret isolation, sandboxing, network egress, repository trust, tool permissions, audit telemetry, generated-code review, and separation between development and production credentials all become relevant controls. A model can be heavily safety-trained and still sit inside an unsafe architecture. A well-controlled model can also be exposed to poisoned project instructions, malicious dependencies, or compromised external tools.
CyberSecEval’s prompt-injection results help explain why relying solely on model refusal behavior is weak security engineering. Anthropic’s reported espionage case shows another side of the problem: attackers attempted to break malicious activity into benign-looking subtasks so the model lacked full context about the operation.
The defensive model that follows from this is familiar. Do not treat an AI agent’s judgment as an authorization boundary. Treat it as software operating inside one.
The Real Shift Is Economic
AI coding agents do not need to become perfect hackers to alter cyber risk.
They need to reduce the amount of expert labor required per task.
A human operator can already create malware. A penetration tester can already search for vulnerabilities. A criminal can already scan the internet. A security engineer can already inspect a patch. The change occurs when one operator can delegate dozens of these activities to agents that work concurrently, retain technical context, generate code, run tools, and retry failed approaches.
The marginal cost of another analysis begins to fall.
That favors defenders with enormous codebases just as much as it favors adversaries with enormous target lists. A security organization might use agents to examine thousands of repositories after a new vulnerability class is disclosed. An attacker may use nearly the same capability to search thousands of applications for exploitable variants.
AI Coding Tools Are Becoming Security Infrastructure
Calling these systems “coding assistants” understates what they are becoming.
The current generation sits at an unusual intersection of source code, developer credentials, execution environments, vulnerability knowledge, security tools, cloud services, and autonomous decision-making. Research has shown agents progressing from insecure code generation to vulnerability exploitation and multi-agent zero-day discovery. Real investigations now document adversaries incorporating coding agents into malware development, exploitation research, extortion, and intrusion workflows. At the same time, Project Zero, DeepMind, DARPA competitors, and security researchers are using related architectures to find and repair vulnerabilities before attackers reach them.
That makes AI coding a textbook dual-use capability.
The security outcome will depend less on whether organizations permit AI coding and more on how much authority those systems receive, what resources they can reach, how their actions are observed, and how quickly defenders learn to use the same automation against adversaries.
The coding agent is no longer sitting beside the security boundary.
It is becoming part of it.
How Can Netizen Help?
Founded in 2013, Netizen is an award-winning technology firm that develops and leverages cutting-edge solutions to create a more secure, integrated, and automated digital environment for government, defense, and commercial clients worldwide. Our innovative solutions transform complex cybersecurity and technology challenges into strategic advantages by delivering mission-critical capabilities that safeguard and optimize clients’ digital infrastructure. One example of this is our popular “CISO-as-a-Service” offering that enables organizations of any size to access executive level cybersecurity expertise at a fraction of the cost of hiring internally.
Netizen also operates a state-of-the-art 24x7x365 Security Operations Center (SOC) that delivers comprehensive cybersecurity monitoring solutions for defense, government, and commercial clients. Our service portfolio includes cybersecurity assessments and advisory, hosted SIEM and EDR/XDR solutions, software assurance, penetration testing, cybersecurity engineering, and compliance audit support. We specialize in serving organizations that operate within some of the world’s most highly sensitive and tightly regulated environments where unwavering security, strict compliance, technical excellence, and operational maturity are non-negotiable requirements. Our proven track record in these domains positions us as the premier trusted partner for organizations where technology reliability and security cannot be compromised.
Netizen holds ISO 27001, ISO 9001, ISO 20000-1, and CMMI Level III SVC registrations demonstrating the maturity of our operations. We are a proud Service-Disabled Veteran-Owned Small Business (SDVOSB) certified by U.S. Small Business Administration (SBA) that has been named multiple times to the Inc. 5000 and Vet 100 lists of the most successful and fastest-growing private companies in the nation. Netizen has also been named a national “Best Workplace” by Inc. Magazine, a multiple awardee of the U.S. Department of Labor HIRE Vets Platinum Medallion for veteran hiring and retention, the Lehigh Valley Business of the Year and Veteran-Owned Business of the Year, and the recipient of dozens of other awards and accolades for innovation, community support, working environment, and growth.
Looking for expert guidance to secure, automate, and streamline your IT infrastructure and operations? Start the conversation today.
Netizen Blog and News 
Leave a comment