Adversarial issue text makes repair agents ship correct-but-insecure patches 51.7% of the time.

SWEADV built 750 adversarial issue descriptions from 150 SWE-bench Verified tasks, five per task across command execution, deserialization, path traversal, DoS and weak hashing (arXiv 2609.15963). Across mini_swe agents on GPT-5-Mini, MiniMax-M2.5 and DeepSeek-R, adversarial issues induced malicious behavior alongside a functionally successful repair in 51.7% of cases. LLM-as-judge screening of the issue text beforehand did not catch them. So the ticket is an untrusted input, and the defense has to sit on the patch, not the request. If you let an agent read issues filed by strangers and open PRs, that's the whole threat model in one sentence.