{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:S5FJ4ZNEXGHSO5P7KZVW2VYFPV","short_pith_number":"pith:S5FJ4ZNE","canonical_record":{"source":{"id":"2507.09329","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.AI","submitted_at":"2025-07-12T16:11:07Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"c188cddc36862dc18e8ba117868a190148f92c97b2908e22f126f0f0ef6c18fa","abstract_canon_sha256":"bb1e89bef23c6489e486193557009c1dece78f6021b8a8e141f0c3f4a015d4c7"},"schema_version":"1.0"},"canonical_sha256":"974a9e65a4b98f2775ff566b6d57057d7e37d33ce601ca008060b597d81d474b","source":{"kind":"arxiv","id":"2507.09329","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2507.09329","created_at":"2026-07-05T11:57:57Z"},{"alias_kind":"arxiv_version","alias_value":"2507.09329v2","created_at":"2026-07-05T11:57:57Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2507.09329","created_at":"2026-07-05T11:57:57Z"},{"alias_kind":"pith_short_12","alias_value":"S5FJ4ZNEXGHS","created_at":"2026-07-05T11:57:57Z"},{"alias_kind":"pith_short_16","alias_value":"S5FJ4ZNEXGHSO5P7","created_at":"2026-07-05T11:57:57Z"},{"alias_kind":"pith_short_8","alias_value":"S5FJ4ZNE","created_at":"2026-07-05T11:57:57Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:S5FJ4ZNEXGHSO5P7KZVW2VYFPV","target":"record","payload":{"canonical_record":{"source":{"id":"2507.09329","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.AI","submitted_at":"2025-07-12T16:11:07Z","cross_cats_sorted":["cs.CR"],"title_canon_sha256":"c188cddc36862dc18e8ba117868a190148f92c97b2908e22f126f0f0ef6c18fa","abstract_canon_sha256":"bb1e89bef23c6489e486193557009c1dece78f6021b8a8e141f0c3f4a015d4c7"},"schema_version":"1.0"},"canonical_sha256":"974a9e65a4b98f2775ff566b6d57057d7e37d33ce601ca008060b597d81d474b","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:57:57.920367Z","signature_b64":"3ss3rn8Bj+K/JGSfohHo5ke/N7sVbyHRCELfcFRvIBTZ0JOtSDNaR6SS6C2UV+m7D6w/nE8FiLtIdlcvm/ydCw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"974a9e65a4b98f2775ff566b6d57057d7e37d33ce601ca008060b597d81d474b","last_reissued_at":"2026-07-05T11:57:57.919873Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:57:57.919873Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2507.09329","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:57:57Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"kWN7GGhhTDpilCgoQIc5M4+sC6z9e3lYP/vpFE2LeqrF7qTTfO70dqwcD3B8XzaP2mtiIhkCkBoo7sRVMWT1BQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-05T03:13:20.448677Z"},"content_sha256":"45681c149c06ace850dbe1081701009e6e1a7a991852e65ca5596d27da2cbda6","schema_version":"1.0","event_id":"sha256:45681c149c06ace850dbe1081701009e6e1a7a991852e65ca5596d27da2cbda6"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:S5FJ4ZNEXGHSO5P7KZVW2VYFPV","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"When Developer Aid Becomes Security Debt: A Systematic Analysis of Insecure Behaviors in LLM Coding Agents","license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","headline":"","cross_cats":["cs.CR"],"primary_cat":"cs.AI","authors_text":"Matous Kozak, Roshanak Zilouchian Moghaddam, Siva Sivaraman","submitted_at":"2025-07-12T16:11:07Z","abstract_excerpt":"LLM-based coding agents are rapidly being deployed in software development, yet their safety implications remain poorly understood. These agents, while capable of accelerating software development, may exhibit unsafe behaviors during normal operation that manifest as cybersecurity vulnerabilities. We conducted the first systematic safety evaluation of autonomous coding agents, analyzing over 12,000 actions across five state-of-the-art models (GPT-4o, GPT-4.1, Claude variants) on 93 real-world software setup tasks. Our findings reveal significant security concerns: 21% of agent trajectories con"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2507.09329","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2507.09329/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:57:57Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"BkEm7qmsa1BfHlMA5Am/H9tWIU3lpNYQdP1+ulj4PG8D5cpVpaWQ2HLlTF3JBu6fq5Vz/x4m0ix96Q5gkMLuBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-05T03:13:20.449536Z"},"content_sha256":"38d48f25391f0d255c055ed910e28a2112fdb5774a1c27e4aa0fb63672b1690e","schema_version":"1.0","event_id":"sha256:38d48f25391f0d255c055ed910e28a2112fdb5774a1c27e4aa0fb63672b1690e"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/S5FJ4ZNEXGHSO5P7KZVW2VYFPV/bundle.json","state_url":"https://pith.science/pith/S5FJ4ZNEXGHSO5P7KZVW2VYFPV/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/S5FJ4ZNEXGHSO5P7KZVW2VYFPV/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-05T03:13:20Z","links":{"resolver":"https://pith.science/pith/S5FJ4ZNEXGHSO5P7KZVW2VYFPV","bundle":"https://pith.science/pith/S5FJ4ZNEXGHSO5P7KZVW2VYFPV/bundle.json","state":"https://pith.science/pith/S5FJ4ZNEXGHSO5P7KZVW2VYFPV/state.json","well_known_bundle":"https://pith.science/.well-known/pith/S5FJ4ZNEXGHSO5P7KZVW2VYFPV/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:S5FJ4ZNEXGHSO5P7KZVW2VYFPV","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"bb1e89bef23c6489e486193557009c1dece78f6021b8a8e141f0c3f4a015d4c7","cross_cats_sorted":["cs.CR"],"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.AI","submitted_at":"2025-07-12T16:11:07Z","title_canon_sha256":"c188cddc36862dc18e8ba117868a190148f92c97b2908e22f126f0f0ef6c18fa"},"schema_version":"1.0","source":{"id":"2507.09329","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2507.09329","created_at":"2026-07-05T11:57:57Z"},{"alias_kind":"arxiv_version","alias_value":"2507.09329v2","created_at":"2026-07-05T11:57:57Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2507.09329","created_at":"2026-07-05T11:57:57Z"},{"alias_kind":"pith_short_12","alias_value":"S5FJ4ZNEXGHS","created_at":"2026-07-05T11:57:57Z"},{"alias_kind":"pith_short_16","alias_value":"S5FJ4ZNEXGHSO5P7","created_at":"2026-07-05T11:57:57Z"},{"alias_kind":"pith_short_8","alias_value":"S5FJ4ZNE","created_at":"2026-07-05T11:57:57Z"}],"graph_snapshots":[{"event_id":"sha256:38d48f25391f0d255c055ed910e28a2112fdb5774a1c27e4aa0fb63672b1690e","target":"graph","created_at":"2026-07-05T11:57:57Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2507.09329/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"LLM-based coding agents are rapidly being deployed in software development, yet their safety implications remain poorly understood. These agents, while capable of accelerating software development, may exhibit unsafe behaviors during normal operation that manifest as cybersecurity vulnerabilities. We conducted the first systematic safety evaluation of autonomous coding agents, analyzing over 12,000 actions across five state-of-the-art models (GPT-4o, GPT-4.1, Claude variants) on 93 real-world software setup tasks. Our findings reveal significant security concerns: 21% of agent trajectories con","authors_text":"Matous Kozak, Roshanak Zilouchian Moghaddam, Siva Sivaraman","cross_cats":["cs.CR"],"headline":"","license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.AI","submitted_at":"2025-07-12T16:11:07Z","title":"When Developer Aid Becomes Security Debt: A Systematic Analysis of Insecure Behaviors in LLM Coding Agents"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2507.09329","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:45681c149c06ace850dbe1081701009e6e1a7a991852e65ca5596d27da2cbda6","target":"record","created_at":"2026-07-05T11:57:57Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"bb1e89bef23c6489e486193557009c1dece78f6021b8a8e141f0c3f4a015d4c7","cross_cats_sorted":["cs.CR"],"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.AI","submitted_at":"2025-07-12T16:11:07Z","title_canon_sha256":"c188cddc36862dc18e8ba117868a190148f92c97b2908e22f126f0f0ef6c18fa"},"schema_version":"1.0","source":{"id":"2507.09329","kind":"arxiv","version":2}},"canonical_sha256":"974a9e65a4b98f2775ff566b6d57057d7e37d33ce601ca008060b597d81d474b","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"974a9e65a4b98f2775ff566b6d57057d7e37d33ce601ca008060b597d81d474b","first_computed_at":"2026-07-05T11:57:57.919873Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:57:57.919873Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"3ss3rn8Bj+K/JGSfohHo5ke/N7sVbyHRCELfcFRvIBTZ0JOtSDNaR6SS6C2UV+m7D6w/nE8FiLtIdlcvm/ydCw==","signature_status":"signed_v1","signed_at":"2026-07-05T11:57:57.920367Z","signed_message":"canonical_sha256_bytes"},"source_id":"2507.09329","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:45681c149c06ace850dbe1081701009e6e1a7a991852e65ca5596d27da2cbda6","sha256:38d48f25391f0d255c055ed910e28a2112fdb5774a1c27e4aa0fb63672b1690e"],"state_sha256":"84fc5c56a12736782f3839662f5c6f01f2f2460652d79a0deef61b6fb598b311"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"3JjDp46IUiEmkvq+qrkyLk3C/jefUK62X7R+EdnmpNCvmCRqYzVBl3pQ/a4qjZ7WMiyq/pG7aR2W3pWSKaR+CQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-05T03:13:20.456162Z","bundle_sha256":"635a5f9492433bf0df80410edd10476884671b90fa69f867560677488e28799b"}}