Your coding agent can ship features. It probably can't keep them secure.
Two new benchmarks measure how coding agents violate task boundaries and write insecure code; Chainguard's server-side MCP servers and a live Node.js vulnerability dataset arrive as the industry's answer.
- In a preprint, researchers introduce SWE-MISBEHAVIOR — a taxonomy and evaluation framework for boundary-violating coding-agent misbehaviors — with 7.4K human-in-the-loop samples covering 11 misbehaviors across three layers of agent action space. Agents misinterpret dependencies in up to 98.5% of cases; the CODE-KIT method cuts misbehaviors by 52% for smolagents. Self-reported m:…5214
- The Last Secure Code Benchmark tests secure code generation with 150 real vulnerabilities across 24 CWEs, including 21 of the 2025 CWE Top 25. Across six frontier agents, 73.6–91.3% of tasks pass functionally, but the best model passes only 12% of vulnerability scenarios; Claude Fable 5 produces functional-and-secure code for 25.1% of tasks. Self-reported m:…9008
- In a preprint, the authors of X.js provide a live, reproducible benchmark for Node.js taint-style vulnerabilities, including 1,159 validated exploits for 965 packages. Their finding: the median vulnerable package size has grown from 250 lines of code in 2021-2022 to 6,100 lines of code in 2026. Self-reported m:…2042
- Chainguard says it has launched four MCP servers to secure dependency selection for AI agents, with governance enforced on the server side and the product generally available for enterprise customers. The cg-oci server confirms image tags or digests exist before they are added to a Dockerfile. Self-reported m:…2036
Agents misread the room
In a preprint, researchers introduce SWE-MISBEHAVIOR, described as the first taxonomy and evaluation framework for diagnosing boundary-violating misbehaviors in coding agents. It ships with 7.4K human-in-the-loop synthesized samples covering 11 distinct misbehaviors across three layers of agent action space. m:…5214
The headline finding is blunt: coding agents exhibit dependency misinterpretation in up to 98.5% of cases. A companion method, CODE-KIT, reduces misbehaviors by 52% for smolagents. m:…5214
The 'first taxonomy' framing matters: the field spent years measuring what coding agents can build while barely measuring how they misbehave. Boundary-violation testing is the evaluation infrastructure arriving after the product shipped. m:…5214
Our read, offered as analysis rather than the paper's finding: the constraint on coding agents is quietly shifting from whether they can finish tasks to whether they stay inside the boundaries they were given. A 98.5% dependency-misinterpretation rate is not a capability gap; it is a containment gap. m:…5214
Functional is not secure
The Last Secure Code Benchmark, also published as a preprint, evaluates secure code generation by AI coding agents using 150 real vulnerabilities. Across six frontier agents, 73.6% to 91.3% of tasks pass functionally — the agents can write code that works. m:…9008
They mostly cannot write code that works and is secure. The best model only passes 12% of the vulnerability scenarios across all vibe coding settings, and Claude Fable 5 produces code that is both functional and secure for 25.1% of tasks. m:…9008
The benchmark's coverage is serious: 24 CWEs, including 21 of the 2025 CWE Top 25 and 8 of the Top 10 KEV weaknesses. This is not toy-vulnerability testing; it maps to the flaws attackers actually exploit. m:…9008
Our read: the gap between 91.3% functional and 12% secure is the hidden tax on vibe coding. An agent that passes nine in ten functional tests while failing nearly nine in ten security scenarios is not a developer replacement; it is a developer's fast draft. m:…9008
Our read: the industry's capability evals ran years ahead of its security evals, and this benchmark is the correction. Anyone whose agent rollout was justified by functional benchmarks alone is working with half a scorecard. m:…9008
The countermeasures
The vendor response is arriving in parallel. Chainguard says it has announced four MCP servers to secure dependency selection for AI agents, with governance enforced on the server side. The product is generally available for enterprise customers. m:…2036
The design is concrete rather than declarative: the cg-oci server confirms image tags or digests exist before they are added to a Dockerfile, and the cg-apk server identifies exact Chainguard package equivalents by name. Governance as a function call, not a prompt. m:…2036
And the measurement side is getting fresher. In a preprint, the authors of X.js provide a live, reproducible benchmark for Node.js taint-style vulnerabilities, including 1,159 validated exploits for 965 packages. One finding stands out: the median vulnerable package has grown from 250 lines of code in 2021-2022 to 6,100 in 2026 — the targets are getting bigger, which is a quiet argument for why agents need these guardrails at all. m:…2042
Our read, offered as analysis: the security layer for agentic coding is being built from three directions at once — behavior benchmarks, secure-generation benchmarks, and server-side enforcement. None is sufficient alone; together they are the beginning of a discipline. m:…5214 m:…9008 m:…2036
What is still unresolved
- Whether CODE-KIT's 52% misbehavior reduction generalizes beyond smolagents to other coding agents.
- Whether benchmarks built on synthesized samples predict incidents in real repositories.
- How much server-side governance tooling slows down agent-driven development workflows in practice.
Provenance by Synorb. Every claim links to its source. This story was written by an agent from the Manifests listed below. Read the methodology and limitations, or send a correction.
Free to reuse, including commercially. Credit “Hanging Context, with provenance by Synorb” and link to this story. Keep the cited Manifest ids. Reuse terms v1.