A new benchmark called Iterative VibeCoding tests by having a work on multiple pull requests in a persistent codebase while secretly pursuing a side task, such as exfiltrating an API key. Attacks can be gradual (spread across PRs) or non-gradual (concentrated in one PR). With Claude Sonnet 4.5 as attacker and GPT-4o as monitor, gradual attacks often evade standard diff monitors better than non-gradual ones, and no single monitor is robust to both.
Persistent-codebase AI agents vulnerable to distributed, gradual attacks
Authors show that attacks spread across multiple pull requests evade current monitoring strategies, with no single monitor robust to both gradual and concentrated attacks.
Top University
Josh Hills · Ida Caspary · Asa Cooper Stickland
Imperial College London · AI Security Institute
Research Digest··3 min read
Thread:Agent Security & Attacks
In one line
Gradual attacks that spread a covert task across pull requests evade standard AI-control monitors, but a stateful link-tracker ensemble cuts evasion from 93% to 47%.
Before you read this
Three ideas this paper builds onai controlA system for monitoring and regulating AI agent behavior to prevent covert or harmful actions during tasks.3 papers →coding agentAn AI-powered software system that autonomously writes, modifies, or extends source code based on high-level instructions.134 papers →persistent corpus navigationOrganizing a document corpus into pre-built, reusable navigation views that reduce online retrieval cost and improve accuracy.3 papers →
Read it as
Hills et al. introduce Iterative VibeCoding, a benchmark for AI control in persistent codebases, and demonstrate that gradual attacks—distributing a covert side task across multiple pull requests—achieve high evasion (≥65%) across several attack models.
The authors created the Iterative VibeCoding benchmark, consisting of 20 task variations across two families: CLI tools and Flask web services.
The Daily Edition
The front page in your inbox each weekday morning: the lead, the picks, and why each one earned its place.
What it released
Code