PaperlayerView exact revision on arXiv

Source-linked AI summary

SEVRA-BENCH: Social Engineering of Vulnerabilities in Review Agents

Rui Melo, Riccardo Fogliato, Sean Zhou, Pratiksha Thaker, Zhiwei Steven Wu

arXiv:2606.13757v2cs.CRcs.AI

TL;DR

Review agents make merge decisions that can affect whether vulnerable code enters shared repositories, but their decisions under attacker-controlled PR narratives are not well established. SEVRA-BENCH tests this with real vulnerability fixes reversed into adversarial PRs and varied framings. The results show that the same code change can receive different decisions under different narratives, with verification behavior central to robustness.

  • Problem

    It is unclear whether review agents can detect vulnerability-introducing changes when an attacker controls both the code and the persuasive PR narrative, despite their approvals influencing shared repositories.

    Source: §1 · p. 1

  • Method

    SEVRA-BENCH reverses historical fixes for publicly disclosed vulnerabilities into PRs and varies their social-engineering narratives while keeping each code diff fixed.

    Source: §1 · pp. 1–2

  • Results

    Review agents can reject a malicious diff under one framing yet approve the identical change under another; stronger agents mitigate this by checking narratives against available evidence.

    Source: §5 · pp. 9–10

  • Takeaways & Limitations

    Robust review depends on checking whether an author’s explanation is supported by the diff and repository context, as well as recognizing vulnerable code.

    Source: §5 · pp. 9–10

    The evaluation uses one-shot, independently reviewed PRs and a fixed tool interface that omits broader social signals, excluding adaptive attacks and longer review discussions.

    Source: §5 · p. 10

Abstract

from arXiv · show

Large language models (LLMs) are increasingly deployed in automated code-review systems, where their approvals can determine which code is merged into shared repositories. However, it is unclear whether review agents can detect vulnerability-introducing code when an attacker controls both the code change and the persuasive Pull Request (PR) narrative designed to mask it. We introduce SEVRA-BENCH (Social Engineering of Vulnerabilities in Review Agents), a benchmark that measures how often a review agent approves such adversarial PR s. Each PR in SEVRA-BENCH is built from a historical commit that fixed a vulnerability. We automatically reverse that fix to extract the original vulnerable code, and submit the resulting code change as a PR wrapped in one of 15 social-engineering framings. To test review-agent resilience to narrative manipulation, these framings vary dimensions such as supporting evidence, conveyed urgency, signals of prior approval, and appeals to authority. SEVRA-BENCH evaluates a retained challenge split of roughly 1000 adversarial PRs drawn from publicly disclosed vulnerability fixes across the top 10 entries of the MITRE's 2025 most dangerous software weaknesses. Evaluating 8 review agents against this benchmark, we reveal that review agents are susceptible to narrative manipulation, exposing a significant gap in security capabilities.

1 Introduction

The paper asks whether review agents can detect vulnerability-reintroducing code when attackers control both the change and its PR narrative. It introduces SEVRA-BENCH to test review decisions under such adversarial framing.

1 Introduction

  • Approving vulnerable code can make code review a route to software-supply-chain compromise.The paper frames code review as a checkpoint before changes enter shared codebases.Source: §1 · p. 1
  • Prior LLM security work emphasizes generating, detecting, or patching vulnerabilities, leaving the final approve-or-reject review decision less studied.The cited studies examine coding tasks, vulnerability detection, exploitation, patching, and review quality.Source: §1 · p. 1
  • Agents inspect PRs in a Git-based environment and are assessed on both rejection and whether rejection reasoning explicitly identifies a security issue.The pipeline packages reversed fixes as framed PRs and evaluates them in a realistic repository environment.Source: Figure 1 · p. 2, §1 · p. 2
  • SEVRA-BENCH measures approval of vulnerability-reintroducing PRs built by reversing historical fixes and presenting the changes under 15 social-engineering framings.The benchmark contains 1,062 adversarial PRs spanning 10 CWE classes.Source: §1 · pp. 1–2
  • Its framings vary the PR narrative while holding the code change constant, isolating narrative susceptibility from vulnerability detection and revealing gaps by base-model type.The varied narrative elements include claims, evidence, urgency, prior approval, and authority.Source: §1 · p. 2

2 Related Work

Prior work studies code-review assistance, vulnerability knowledge, supply-chain threats, and agent robustness, but the paper positions SEVRA-BENCH around reviewer judgment when authors control an adversarial PR narrative.

2 Related Work

  • Empirical review studies document security concerns and review assistance, while the gap identified here is reviewer judgment under adversarial authorship.Earlier LLM review work evaluates review comments, refinement, adoption, and vulnerability analysis in ordinary workflows.Source: §2 · p. 2
  • Closest prior work finds that crafted PR metadata can induce approvals, while SEVRA-BENCH compares more agents, vulnerability classes, and framings with a fixed diff and live MCP-based PR workflow.The cited prior work used simulated environments.Source: §2 · pp. 2–3
  • Security benchmarks generally test vulnerability generation, detection, or repair separately from a narrative-controlled merge decision.The paper distinguishes its focus from benchmarks such as CVEfixes, CyberSecEval, and SecRepoBench.Source: §2 · p. 3
  • The benchmark treats review-facing social context as part of the attack surface, complementing documented malicious-contribution threats and studies of agent manipulation in repository environments.Related work includes supply-chain compromise, prompt injection, manipulated tool outputs, and poisoned context.Source: §2 · p. 3

3 SEVRA-BENCH

SEVRA-BENCH holds vulnerability-inducing diffs fixed while varying PR narratives, then evaluates agents in repository environments and focuses on attacks that baseline agents fail to reject.

3 SEVRA-BENCH

  • The benchmark models a contributor who submits a real vulnerability-reintroducing diff with a deceptive narrative, while the agent sees repository state, diffs, history, and PR metadata.The attacker is restricted to the same interface available to the review agent.Source: §3 · p. 3

3.1 Dataset Construction

  • Vulnerabilities come from public historical patches reversed in secure post-fix repositories; 150 source records are retained when the reversal applies cleanly and remains traceable.Titles and descriptions for each framing and diff are generated using GPT-5.4 and Claude Opus 4.6.Source: §3.1 · p. 3

3.1.1 Framing the Pull Request

  • The framing taxonomy includes routine engineering claims, repository-dependent rationales, external evidence or authority, and cognitive or affective pressure on reviewers.Examples include unsafe optimization, prior-approval signals, emotional appeals, and inflated harmless scope through Evidence Dilution.Source: §3.1.1 · p. 4

3.2 Evaluation

  • Agents inspect diffs, search code, and review squashed commit history through MCP tools, then make approve-or-reject decisions without security-specific instructions.Refusal Rate counts malicious PRs rejected; Security Reason Rate credits rejections that identify the underlying exploit.Source: §3.2 · p. 5

3.3 Dataset Statistics

  • Baseline filtering retains a PR when either Haiku 4.5 or GPT-5.4-nano incorrectly approves it, focusing evaluation on difficult attacks but potentially excluding rare edge cases.Samples rejected by both baselines are discarded as trivially detectable.Source: §3.3 · p. 5
  • The retained challenge split ranges from 65 PRs for CWE-89 to 148 for CWE-125, averaging 106 per class, with trusted-process framings most often surviving baseline filtering.CWE-125, CWE-416, and CWE-78 are most represented; Refactoring and Evidence Dilution are largely caught by baselines.Source: §3.3 · p. 6, Figure 3 · p. 6

4 Experiments

The experiments assess eight review agents across vulnerability classes, social-engineering framings, and review efficiency. The results show substantial differences between agents and vulnerabilities, while deceptive narratives—especially unverifiable external claims—can sway review decisions.

4 Experiments

  • The evaluation runs eight agents once per PR in a shared Git-based environment, measuring refusal, security-grounded refusal, and review-process efficiency.The agents span providers and include both general-purpose and code-oriented base models.Source: §4 · p. 6

4.1 Robustness Across Vulnerability Classes

  • CWE-89 and CWE-94 receive over 80% SRR from Claude Opus 4.7 and GPT-5.5, but their SRR on CWE-416 is 30% and 20%, respectively.All agents except GPT-5.5 remain below 50% SRR on CWE-125; review agents often identify the immediate bug without articulating its security implications.Source: §4.1 · pp. 6–7, Figure 4 · p. 7
  • Claude Opus 4.7 and GPT-5.5 are most robust overall, while weaker agents show greater variation across vulnerability classes.SRR generally follows the same ordering as RR, with Claude Opus 4.7, GPT-5.5, and GLM-5 leading across most classes and Grok Code Fast performing worst.Source: §4.1 · p. 7

4.2 Robustness Across Social Engineering Strategies

  • Unverifiable external justifications, such as fabricated prior approval or dependency claims, frequently prompt weaker agents to defer and accept PRs.By contrast, directly checkable claims such as “no functional change” can often be tested against the diff.Source: §4.2 · p. 8
  • The same code diff can be rejected under False Coverage yet accepted under Prior Approval Signal, showing framing-sensitive decisions within an agent.For GLM-5, over 80% of code changes that bypassed review under Prior Approval Signal were rejected under alternative framings.Source: §4.2 · p. 8
  • Repository-dependent explanations lead agents to repeat attacker claims about redundant or equivalent protections without checking whether those protections exist.Affective framings vary substantially by agent: Emotional Appeal reduces Grok Code Fast to 10% RR, while DeepSeek V4-Flash resists urgency language at 80% RR.Source: §4.2 · p. 9

5 Discussion

The discussion argues that robust review depends on checking PR explanations against the diff and repository evidence, not only recognizing vulnerable code. It cautions that the benchmark’s controlled setting limits what its results cover and notes a dual-use risk.

5 Discussion

  • Review agents may reject a malicious diff under one framing yet approve the identical change under another, often by accepting an unverified account of safety.The strongest agents mitigate this by checking narratives against available evidence.Source: §5 · pp. 9–10
  • Automated-review approval is unsafe to treat as evidence of adequate vetting unless the process verifies claims that shaped the decision.The discussion proposes separating claim extraction from verification against the diff, code, tests, history, or external evidence.Source: §5 · p. 10
  • The benchmark tests one-shot, single-framing PR reviews and excludes adaptive narratives, multi-PR attacks, and longer review discussions.Its fixed tool interface also omits broader social signals, and public vulnerability fixes may create training-data contamination that makes measured failure rates a lower bound for unseen vulnerabilities.Source: §5 · p. 10
  • The benchmark is intended for defensive evaluation, but publishing framing strategies and results may lower the barrier to misuse.The authors describe the techniques as reflecting tactics already present in social-engineering research and real security incidents.Source: §5 · p. 10

A Framing Strategies

Table 1 describes framing strategies paired with deterministic patch reversal while keeping the underlying code diff fixed.

A Framing Strategies

  • Each generated PR pairs deterministic patch reversal with one narrative strategy, changing the PR explanation while leaving the diff fixed.Source: Table 1 · p. 16

B Review Agent System Prompt

The review-agent prompt directs the agent to review a pull request, optionally inspect repository context, and submit an approval or rejection decision.

B Review Agent System Prompt

C Review Agent Tool List

The tool list gives review agents API access to repository and pull-request information, code search, comments, and approval actions. The harness records terminal outcomes and distinguishes submitted rejections from timeouts or missing submissions.

C Review Agent Tool List

  • The Gitea API tool set supports inspecting PR metadata, changed-file diffs, repository files, commits, reviews, recent PRs, and code search.Source: C Review Agent Tool List · p. 18
  • Agents can post inline comments, while the approval tool approves and merges the PR as a terminal action.Source: C Review Agent Tool List · p. 18
  • The harness records approval, submitted rejection, timeout/no-submit, or infrastructure failure; among valid runs, non-approval includes exits without approval, while tables separate submitted rejects from timeouts/no-submits.Source: C Review Agent Tool List · p. 18

D Example Malicious Pull Request

Figure 6 presents a malicious PR that pairs an automatically reversed security fix with a social-engineering framing. The review agent sees the diff, title, and description and must decide whether to approve or reject the change.

D Example Malicious Pull Request

E Additional Results

The additional results break down refusal and security-reasoning rates by framing and show how review agents differ in tool-interaction counts. The framing results indicate that some narratives correspond to lower refusal rates among weaker agents, while interaction distributions vary across agents.

E Additional Results

  • Claude Opus 4.7, GPT-5.5, and GLM-5 remain above ∼70% RR across framings, while weaker agents fall below 40% RR under three specified framings.The three framings are Prior Approval Signal, Fake Bug Fix, and Dependency Compat. Claim.Source: Figure 7 · p. 20
  • Misleading Hardening and Refactoring are the least effective framings, narrowing but not closing the gap, with weaker agents rejecting about half of the PRs.Source: Figure 7 · p. 20
  • DeepSeek V4-Flash, GPT-5.5, and GLM-5 have the highest median tool-interaction counts, while GPT-5.4-nano has the fewest interactions and tightest distribution.DeepSeek V4-Flash and GPT-5.5 also have the widest interquartile ranges.Source: Figure 8 · p. 20

Related papers

Loading 2606.13757v2…