Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-09-10 · high
A benchmark called CS-Guard found code-to-code attack success as low as 14.4% against some guardrails and near 100% against others.
Why now: CS-Guard's numbers on the code-to-code gap are current as of September 10, 2026.
CS-Guard ran 331 code-to-code prompts, covering infilling, completion, and translation, through nine guardrails and seven LLMs. Refactoring and code-translation agents run this exact prompt pattern every time they rewrite a file. Attack success against it ranged from 14.4% to near 100%, depending on the guardrail.
The same evaluation used 1,000 malware prompts and 7 jailbreaks to test the text-to-code path on the same guardrails. Text-to-code jailbreaks, the attack most guardrails are built to catch, still got through about half the time.
A new attack the researchers built, wrapping malicious intent in a fictional software-development story, hit close to 100% against many guardrails.
The paper doesn't say how these guardrails were trained, or whether any targeted code-to-code inputs at all. Most public guardrail work targets jailbreak text and prompt injection, not requests to translate or complete a file. A team running a guardrail in front of a coding agent may catch malicious prompts while missing malicious code handed straight to the model. That gap in training data may explain why.
Each link below shares sources, entities, or timing with this story.
Tencent's SkillJack work (arXiv 2608.03509) shows self-evolving agents launder malicious intent during skill extraction. Attack success rates of 56.2% on SkillX and 89.2% on Anything2Skill, with 80% of implanted skills surviving deletion of the original poisoned records. If yo...
Sleeper Cell (2603.03371) — Two-stage attack embeds latent malicious behavior in fine-tuned tool-using LLMs. Poisoned models pass all benchmarks while harboring temporal trigger-activated harmful tool calls. Direct supply-chain risk for anyone using third-party LoRA adapters....
Reflex-Guard combines jailbreak-aware preprocessing, compact sentence-transformer embeddings and seven binary classifiers trained on 30,568 samples, reporting 95.9% recall end-to-end against 255ms for Llama Guard 2 and 723ms for SafeDecoding, with 100% detection of GCG suffix...
arXiv 2608.09476 ran 24,000 trajectories across 15 LLMs and 6 cowork agents, finding variation across base models (10.1%–94.4%) far exceeds variation across harnesses (73.7%–94.4%). Note the harness floor: 73.7%. No harness tested brought attack success anywhere near zero. SAD...
A paper submitted July 23 benchmarks open-weight LLMs as coding agents across a consumer-grade deployment spectrum on 20 longitudinal data-preparation tasks producing 102 variables, reporting that current 31-35B models "almost saturated the benchmark" with average task complet...
Speculative Probing appends a trained soft prompt to the end of the target sequence, turning the speculative-decoding module recent LLMs already run into a sequence classifier. Because the KV cache is already resident in a speculative-decoding pipeline, classification adds neg...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.