Breaking the Code: Security Assessment of AI Code Agents Through Systematic Jailbreaking Attacks
arXiv:2510.01359v2 Announce Type: replace-cross Abstract: Code-capable large language model (LLM) agents are embedded in software engineering workflows where they can read, write, and execute code, raising "jailbreak" stakes beyond text-only settings. Prior evaluations emphasize refusal or harmful-text detection, leaving open whether agents compile and run malicious programs. We present JAWS-Bench (Jailbreaks Across WorkSpaces), a benchmark spanning three escalating workspace regimes mirroring attacker capability: empty (JAWS-0), single-file (JAWS-1), and multi-file (JAWS-M). We pair this with
The proliferation of code-capable LLM agents in software engineering workflows necessitates a deep dive into their security vulnerabilities, especially as they move beyond text and into execution environments.
This research highlights critical security risks in autonomous AI agents, demonstrating how they can be 'jailbroken' to compile and run malicious code, which can have significant real-world implications beyond traditional AI harms.
The understanding of AI agent security expands from preventing harmful text generation to actively mitigating risks associated with malicious code execution in integrated software environments.
- · Cybersecurity firms
- · AI safety researchers
- · Secure software development platforms
- · Companies with unhardened AI code agents
- · Software supply chains
- · Developers neglecting agent security
Increased focus on robust security frameworks and adversarial testing for AI agents embedded in software development tools.
Development of new industry standards and regulations for secure AI agent deployment and interaction with sensitive systems.
A potential slowdown in the widespread adoption of fully autonomous AI code agents until these security concerns are adequately addressed, leading to more human-in-the-loop oversight.
This signal links to a primary source. Continuum Brief monitors and indexes it as part of the live intelligence stream — we do not republish source content.
Read at arXiv cs.AI