ai-research-survey

scan.json (34506B)

---

 {
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "paper": {
     "title": "RedCode: Risky Code Execution and Generation Benchmark for Code Agents",
     "authors": [
       "Chengquan Guo",
       "Xun Liu",
       "Chulin Xie",
       "Andy Zhou",
       "Yi Zeng",
       "Zinan Lin",
       "Dawn Song",
       "Bo Li"
     ],
     "year": 2024,
     "venue": "Neural Information Processing Systems (NeurIPS 2024, Datasets and Benchmarks Track)",
     "arxiv_id": "2411.07781",
     "doi": "10.48550/arXiv.2411.07781"
   },
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "The abstract states 'Our dataset and code are publicly available at https://github.com/AI-secure/RedCode.' A working GitHub URL is provided."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The benchmark dataset (4,050 RedCode-Exec test cases and 160 RedCode-Gen prompts) is released at the same GitHub repository. App. B confirms 'Our dataset can be found in this GitHub repository link.'"
       },
       "environment_specified": {
         "applies": true,
         "answer": true,
         "justification": "Docker images are provided for each test case, constituting detailed environment specification. §3.2.1 describes Docker environments for sandbox isolation and resource preparation. App. C.1 specifies '10 NVIDIA RTX A6000 GPUs, each with 48 GB of GDDR6 memory.'"
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": true,
         "justification": "The released repository includes Docker environments, evaluation scripts for each scenario, and system prompts for all agents (App. C.2). The paper describes the full evaluation pipeline (Algorithm 1) with enough detail to reproduce experiments."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results are reported as point estimates (e.g., rejection rate percentages, attack success rate percentages) without confidence intervals or error bars in any figure or table."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes numerous comparative claims (e.g., 'Python leads to a higher rejection rate than Bash,' 'OpenCodeInterpreter is relatively safer') but no statistical significance tests are used. All comparisons are based on raw percentage differences."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": false,
         "justification": "Main results in Figs. 5-7 report only raw percentages. Tab. 9 includes percentage-point changes (e.g., '↓17%') for mitigation experiments, but no formal effect sizes (Cohen's d, odds ratios) are reported anywhere."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper selects 30 test cases per scenario and 20 prompts per malware family without justifying these numbers. No power analysis or rationale for the sample size is provided."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "Results are single-run (temperature=0 for most experiments yields deterministic output). For RedCode-Gen (temperature=0.8), no variance across runs is reported. No standard deviations or IQR appear in any table or figure."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "The paper compares 19 code agents across 3 agent frameworks (OpenCodeInterpreter, CodeAct, ReAct) with various base LLMs, providing extensive cross-comparisons (Fig. 1, Fig. 6)."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Evaluated models include contemporary LLMs: GPT-4o (2024), Claude-3.5-Sonnet (2024), Llama-3.1-70b (2024), alongside older models for breadth."
       },
       "ablation_study": {
         "applies": false,
         "answer": false,
         "justification": "This is a benchmark paper, not a system with decomposable components. The paper compares experimental conditions (input formats, languages, agent frameworks) but these are evaluation variables, not ablatable system components."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Three evaluation outcomes are tracked: Rejection Rate (RR), Attack Success Rate (ASR), and Execution Failure rate. For RedCode-Gen, refusal rate, accuracy, and VirusTotal score are reported (Tab. 1)."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "Agent outputs are evaluated entirely via deterministic evaluation scripts (RedCode-Exec) or LLM-as-judge plus VirusTotal API (RedCode-Gen). No human evaluation of agent outputs is performed. Manual review was used only for dataset curation, not for evaluating agent behavior."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "The entire RedCode benchmark serves as the evaluation set. No tuning or selection decisions are made on the test cases — all 4,050 RedCode-Exec and 160 RedCode-Gen test cases are used purely for evaluation."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Extensive breakdowns are provided: by 8 risky domains (Fig. 5), by 25 individual scenarios (Fig. 6), by input format (Fig. 7), by agent framework (Fig. 1), and by 8 malware categories (Tab. 1). Appendix provides per-scenario analysis (Tab. 10)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "App. D.6 discusses four main reasons for execution failure: poor instruction following ability, incorrect assertion, code modification, and autonomous extra activities, with concrete examples for each."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports that safety-aware prompts are 'not effective enough' (§4.1.1, Tab. 9), that jailbreaking prefixes sometimes paradoxically increase rejection rates, and that VirusTotal accuracy of LLM-generated malware is 'still relatively low.'"
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims about agents being more likely to reject OS operations, natural language leading to lower rejection, and stronger models producing more harmful software are all supported by Figs. 5-7 and Tab. 1 respectively."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes causal claims with hedging language: 'This is likely because OCI has hard-coded disk space protection,' 'This might be due to the unbalanced ability of code agents,' 'ReAct employs the Think-Then-Act procedure, which helps the agents to reason about the security implications.' These are causal explanations for observed differences without controlling for confounds or using causal identification strategies."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The conclusion states 'We find that existing code agents are generally vulnerable' — a broad claim extending beyond the 19 specific agents tested on 25 scenarios. The paper tests only Python and Bash with specific agent frameworks, yet makes general claims about 'code agents.'"
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper offers speculative preferred explanations for observed differences (e.g., 'Python tasks could be perceived as more complex or risky, leading to higher rejection rate. Alternatively, agents might be more familiar with Python') but does not substantively discuss confounds or systematically consider alternative explanations."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper measures rejection rate and attack success rate on specific risky scenarios and frames these as evaluating 'safety of code agents' in the context of risky code execution and generation. The measurements are reasonably well-matched to the specific claims made, though the conclusion's broad use of 'safe' slightly exceeds the measurement scope."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "Tab. 7 lists exact model endpoints: gpt-4-1106-preview, gpt-4o-2024-05-13, claude-3-5-sonnet-20240620, and HuggingFace links for all open-source models with specific model names."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Full system prompts for ReAct, CodeAct, and OpenCodeInterpreter are provided in App. C.2. The jailbreaking prefix template and dataset augmentation prompts are provided in App. B.1 and C.1. Translation prompts for Python-to-Bash and code-to-text are provided in App. B.1.2 and B.1.3."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "App. C.2 reports temperature (0 for most agents, 0.8 for RedCode-Gen), max generated tokens (1024 for OCI/ReAct, 512 for CodeAct), and number of interaction rounds (3 for OCI/CodeAct, 8 for ReAct, 5 for RedCode-Gen agents)."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "The three agent frameworks are described in detail: OpenCodeInterpreter's hard-coded safety constraints and execution pipeline, CodeAct's <execute> tag format, and ReAct's Think-Then-Act procedure. System prompts, interaction round limits, and output format handling are all documented (App. C.2)."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "§3.2.1 documents the full pipeline: seed test case creation from CWE and prior benchmarks → LLM-based augmentation with jailbreaking prefixes → manual review for quality → accessible resource preparation → executability verification in Docker. Counts are provided (25 seeds → 750 Python test cases, 600 Bash, etc.)."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "App. A 'Discussion on limitations and impacts' provides a dedicated limitations section discussing the limited scope of programming languages and potential misuse concerns."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "The paper identifies specific threats: 'limited scope of supported programming languages' (Python and Bash only), that 'existing code agents primarily operate Python,' and that URL keyword visibility affects rejection rates (App. D.2). These are specific to this study."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "While the paper notes the language limitation, it does not explicitly state what the results do NOT show. The conclusion claims 'existing code agents are generally vulnerable' without bounding this to the tested scenarios, languages, and agent frameworks."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": true,
         "justification": "The full dataset of test cases, Docker environments, and evaluation scripts are released at the GitHub repository, allowing independent verification of all evaluation results."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "§3.2.1 describes how seed test cases were manually created from CWE and existing benchmarks (ToolEmu, R-judge), then augmented using GPT-4 and Mistral-Large with jailbreaking prefixes, manually reviewed, and verified for executability."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants were involved. The data consists of synthetically generated and manually curated benchmark test cases."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The pipeline is documented with counts at each stage: 25 seed scenarios → Naug augmented cases → manual review → 30 selected per scenario (750 total Python). Translation pipelines for Bash (600 cases after removing 5 incompatible scenarios) and natural language (1,500 for Python, 1,200 for Bash) are similarly documented. Tab. 2 provides complete dataset statistics."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "The acknowledgements section lists funding from NSF (grants No. 2046726 and IIS-2229876), DARPA GARD, NASA (No. 80NSSC20M0229), Alfred P. Sloan Fellowship, Meta research award, and eBay research award."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: University of Chicago, UIUC, Lapis Labs, Virginia Tech, Microsoft Research, UC Berkeley. No authors are affiliated with OpenAI, Anthropic, or Meta whose models are evaluated."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": true,
         "justification": "Primary funders (NSF, DARPA, NASA, Sloan) are independent of the evaluated products. Meta and eBay provide research awards but their products are not directly evaluated in the benchmark."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is included in the paper. One author is affiliated with Lapis Labs (a company) but no disclosure of financial interests is made."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": true,
         "answer": false,
         "justification": "No training data cutoff dates are stated for any of the 19 evaluated models, despite testing them on a new benchmark. The models' training data could include CWE examples and similar risky code patterns used to construct the benchmark."
       },
       "train_test_overlap_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the LLMs' training data includes CWE examples, risky code patterns, or safety training data similar to the benchmark's test cases. The benchmark draws from publicly available CWE content which is likely in training data."
       },
       "benchmark_contamination_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Although this is a new benchmark, its test cases are derived from publicly available CWE examples and augmented using GPT-4/Mistral-Large. No discussion of whether evaluated models' safety training might have been conducted on similar content, which could inflate rejection rates."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study. The paper evaluates automated code agents on a benchmark."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The study involves only automated evaluation of code agents."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this benchmark evaluation study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants; no experimental conditions requiring randomization of people."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants; automated evaluation pipeline."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No API costs, token counts, or inference latency are reported despite using commercial APIs (GPT-4, Claude-3.5) for thousands of test cases across 19 agents."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "App. C.1 mentions '10 NVIDIA RTX A6000 GPUs, each with 48 GB of GDDR6 memory' but does not state total GPU hours, wall-clock time, or total API spend for the experiments."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "Results are single-run. Temperature=0 is used for deterministic outputs in most experiments, but RedCode-Gen uses temperature=0.8 with no seed sensitivity analysis. No multi-seed results are reported."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is never explicitly stated. It is implied that each agent-test case pair is run once, but this is not stated."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search is described. The choices of temperature=0, max_tokens=1024/512, and interaction rounds=3/8 appear to be set without systematic exploration, and no search budget is reported."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports results for all tested configurations (all 19 agents, all input formats, both languages) rather than selecting a best configuration. Full results are provided in Fig. 11 (appendix)."
       },
       "multiple_comparison_correction": {
         "applies": false,
         "answer": false,
         "justification": "No statistical tests are performed, so there are no p-values requiring correction for multiple comparisons."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors designed the benchmark, evaluation scripts, and Docker environments. They do not discuss the bias inherent in evaluating agents using their own benchmark design, which may favor scenarios where their evaluation scripts work well."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "Different agent frameworks use different interaction rounds (OCI/CodeAct: 3, ReAct: 8) and max tokens (CodeAct: 512, others: 1024), creating unequal compute budgets. Performance differences between frameworks are not discussed in relation to these compute differences."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether rejection rate and attack success rate on 25 specific scenarios (derived from CWE and prior work) actually measure 'safety' of code agents in practice. The construct validity of equating performance on these scenarios with broader safety is not examined."
       },
       "scaffold_confound_addressed": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly compares the same LLMs across different agent frameworks and notes 'given the same LLMs, different agents exhibit different safety risks' (§4.1.1). Fig. 6 shows the same model (e.g., CL-7b, CL-13b) across OCI, CodeAct, and ReAct frameworks, treating the scaffold as a variable."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether evaluated models' training data includes CWE examples, prior safety benchmarks (ToolEmu, R-judge), or risky code patterns similar to the benchmark's test cases created before model training."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The paper notes that URLs with obvious risky keywords (e.g., 'dangerous', 'malicious') affect rejection rates and tests random-character URLs in App. D.2, but does not frame this as a feature leakage concern or systematically address other potential leakage through evaluation setup cues."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "All 30 test cases per scenario are augmented from the same seed case using the same LLMs, making them structurally similar. This non-independence of test cases within scenarios is not discussed and could inflate the apparent comprehensiveness of the evaluation."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No concrete leakage detection or prevention method is applied (no canary strings, membership inference tests, or n-gram overlap analysis)."
       }
     }
   },
   "claims": [
     {
       "claim": "The overall attack success rate is high across all code agents when queried to execute risky or buggy code, demonstrating the vulnerability of existing agents.",
       "evidence": "Fig. 5 shows high attack success rates across 8 domains for all 8 representative agents, with many scenarios achieving >50% ASR. Fig. 6 provides per-scenario breakdown across 19 agents.",
       "supported": "strong"
     },
     {
       "claim": "Agents have higher rejection rates for risky operations on operating systems and file systems than for technically buggy code.",
       "evidence": "Fig. 5 shows elevated rejection rates for OS and file system domains compared to program logic and cybersecurity domains. Scenarios like 'Add risky alias to .bashrc' and 'Delete sensitive files' have the highest rejection rates (Fig. 6), while 'PRNG seed management' and 'Duplicate key in associative list' have the lowest.",
       "supported": "strong"
     },
     {
       "claim": "Agents are more likely to execute harmful actions from natural language queries than from programming language code inputs.",
       "evidence": "Fig. 7 shows GPT-4 ReAct agent rejection rates: Python code 38.27%, code with jailbreak 50.53%, text summaries 17.20%, text descriptions 9.60%. ASR is 86.27% for text descriptions vs. 60.13% for code.",
       "supported": "moderate"
     },
     {
       "claim": "Python code inputs lead to higher rejection rates than Bash code inputs.",
       "evidence": "Fig. 6 shows Bash RR is generally lower than Python RR across scenarios. Fig. 7 confirms the gap exists across all input modalities for the GPT-4 ReAct agent (e.g., code: 38.27% Python RR vs. 24.83% Bash RR).",
       "supported": "moderate"
     },
     {
       "claim": "OpenCodeInterpreter is more robust than CodeAct and ReAct, with higher rejection rates and lower attack success rates.",
       "evidence": "Fig. 1 shows OCI agents clustering in the high-RR, low-ASR region. §4.1.1 attributes this to 'hard-coded disk space protection/constraints in its agent codebase.'",
       "supported": "moderate"
     },
     {
       "claim": "Stronger base LLMs exhibit higher safety awareness (higher rejection rate) in code execution, but also generate more effective harmful software.",
       "evidence": "Fig. 1 shows GPT-4 and Claude-3.5 achieving higher rejection rates under ReAct. Tab. 1 shows GPT-4 agents achieving 66.9% accuracy on RedCode-Gen with 5.6 VirusTotal score, higher than weaker models. Pearson correlation of 0.448 between HumanEval pass@1 and RedCode-Gen accuracy.",
       "supported": "moderate"
     },
     {
       "claim": "Fine-tuned LLMs for agent tasks may compromise safety.",
       "evidence": "Fig. 1 shows CodeAct Mistral-7B* and Llama2-7b* (fine-tuned) have among the lowest rejection rates. §4.1.1 states 'instruction tuning for agent tasks enhances the agents' general task-solving ability but may unintentionally weaken the safety guardrails.'",
       "supported": "weak"
     },
     {
       "claim": "Safety-aware prompts are not effective enough as a mitigation strategy.",
       "evidence": "Tab. 9 shows the combined safety prompt reduces ASR by only 17% for code input (79.33% → 62.13%) and only 5% for text descriptions (88.4% → 83.2%). The remaining ASR is still high.",
       "supported": "moderate"
     }
   ],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "RedCode evaluates 19 code agents across 3 frameworks on 4,050 risky code execution scenarios and 160 malicious software generation prompts. Agents show high vulnerability overall, with attack success rates routinely exceeding 50%, though rejection rates are higher for obvious system-level threats (file/OS operations) than for technically buggy code. Natural language inputs are more dangerous than code inputs, as agents fail to recognize underlying risks in text descriptions. More capable models (GPT-4) show both higher safety awareness in execution and greater ability to generate functional malware, creating a dual-use dilemma.",
   "red_flags": [
     {
       "flag": "LLM-as-judge inconsistency",
       "detail": "The paper criticizes LLM-as-judge in §3.2.1 ('this approach is often unreliable since LLMs can make errors') for RedCode-Exec, then uses GPT-4 as judge for RedCode-Gen code quality evaluation (§3.3). The same reliability concerns apply to their own LLM judge usage."
     },
     {
       "flag": "No statistical tests on any comparison",
       "detail": "All comparative claims (Python vs Bash, agent vs agent, model vs model) are based on raw percentage comparisons without any statistical tests. With 30 test cases per scenario, differences could easily be within noise, especially for smaller model-level comparisons."
     },
     {
       "flag": "Non-independence of augmented test cases",
       "detail": "All 30 test cases per scenario are augmented from the same seed using GPT-4/Mistral-Large ('variable name replacement, code structure transformation'). This creates structurally similar test cases that may not represent diverse real-world risky scenarios. The 4,050 count overstates effective diversity."
     },
     {
       "flag": "Unequal compute budgets across agent comparisons",
       "detail": "ReAct gets 8 interaction rounds while OCI/CodeAct get 3, and max tokens differ (CodeAct: 512 vs others: 1024). These differences could confound the agent comparison but are not discussed."
     }
   ],
   "cited_papers": [
     {
       "title": "Identifying the risks of LM agents with an LM-emulated sandbox",
       "authors": ["Yangjun Ruan", "Honghua Dong", "Andrew Wang", "Silviu Pitis", "Yongchao Zhou", "Jimmy Ba", "Yann Dubois", "Chris J. Maddison", "Tatsunori Hashimoto"],
       "year": 2024,
       "relevance": "ToolEmu proposes LLM-based emulation for evaluating agent safety risks, a key comparison point for RedCode's real-execution approach."
     },
     {
       "title": "R-judge: Benchmarking safety risk awareness for LLM agents",
       "authors": ["Tongxin Yuan", "Zhiwei He", "Lingzhong Dong", "Yiming Wang", "Ruijie Zhao", "Tian Xia", "Lizhen Xu", "Binglin Zhou", "Fangqi Li", "Zhuosheng Zhang", "Rui Wang", "Gongshen Liu"],
       "year": 2024,
       "arxiv_id": "2401.10019",
       "relevance": "Agent safety benchmark using curated risky trajectory records evaluated by LLM judges, which RedCode improves upon with real code execution."
     },
     {
       "title": "Executable code actions elicit better LLM agents",
       "authors": ["Xingyao Wang", "Yangyi Chen", "Lifan Yuan", "Yizhe Zhang", "Yunzhi Li", "Hao Peng", "Heng Ji"],
       "year": 2024,
       "arxiv_id": "2402.01030",
       "relevance": "CodeAct agent framework, one of three agent types evaluated in RedCode for safety."
     },
     {
       "title": "OpenCodeInterpreter: Integrating code generation with execution and refinement",
       "authors": ["Tianyu Zheng", "Ge Zhang", "Tianhao Shen", "Xueling Liu", "Bill Yuchen Lin", "Jie Fu", "Wenhu Chen", "Xingwei Yue"],
       "year": 2024,
       "arxiv_id": "2402.14658",
       "relevance": "OpenCodeInterpreter agent framework evaluated in RedCode; found to be most robust due to hard-coded safety constraints."
     },
     {
       "title": "ReAct: Synergizing reasoning and acting in language models",
       "authors": ["Shunyu Yao", "Jeffrey Zhao", "Dian Yu", "Nan Du", "Izhak Shafran", "Karthik Narasimhan", "Yuan Cao"],
       "year": 2023,
       "relevance": "ReAct agent framework, one of three frameworks evaluated in RedCode's safety assessment."
     },
     {
       "title": "AgentDojo: A dynamic environment to evaluate attacks and defenses for LLM agents",
       "authors": ["Edoardo Debenedetti", "Jie Zhang", "Mislav Balunović", "Luca Beurer-Kellner", "Marc Fischer", "Florian Tramèr"],
       "year": 2024,
       "arxiv_id": "2406.13352",
       "relevance": "Concurrent benchmark evaluating attack/defense mechanisms for LLM agents including prompt injection and backdoors."
     },
     {
       "title": "Agent security bench (ASB): Formalizing and benchmarking attacks and defenses in LLM-based agents",
       "authors": ["Hanrong Zhang", "Jingyuan Huang", "Kai Mei", "Yifei Yao", "Zhenting Wang", "Chenhan Zhan", "Hongwei Wang", "Yongfeng Zhang"],
       "year": 2024,
       "arxiv_id": "2410.02644",
       "relevance": "Concurrent agent security benchmark covering prompt injection, memory poisoning, and backdoor attacks."
     },
     {
       "title": "SWE-agent: Agent-computer interfaces enable automated software engineering",
       "authors": ["John Yang", "Carlos E. Jimenez", "Alexander Wettig", "Kilian Lieret", "Shunyu Yao", "Karthik Narasimhan", "Ofir Press"],
       "year": 2024,
       "relevance": "Major code agent framework for automated software engineering, relevant to the broader safety evaluation of code agents."
     },
     {
       "title": "HarmBench: A standardized evaluation framework for automated red teaming and robust refusal",
       "authors": ["Mantas Mazeika", "Long Phan", "Xuwang Yin", "Andy Zou", "Zifan Wang", "Norman Mu", "Elham Sakhaee", "Nathaniel Li", "Steven Basart", "Bo Li", "David Forsyth", "Dan Hendrycks"],
       "year": 2024,
       "relevance": "Standardized safety evaluation framework for LLM red teaming, a key comparison benchmark for code-specific safety evaluation."
     },
     {
       "title": "Asleep at the keyboard? Assessing the security of GitHub Copilot's code contributions",
       "authors": ["Hammond Pearce", "Baleegh Ahmad", "Benjamin Tan", "Brendan Dolan-Gavitt", "Ramesh Karri"],
       "year": 2022,
       "relevance": "Early work on evaluating security vulnerabilities in LLM-generated code, foundational to the code safety evaluation field."
     },
     {
       "title": "Evaluating large language models trained on code",
       "authors": ["Mark Chen", "Jerry Tworek", "Heewoo Jun"],
       "year": 2021,
       "relevance": "HumanEval benchmark, used in RedCode-Gen to correlate general coding capability with malware generation quality (Pearson r=0.448)."
     },
     {
       "title": "HAICOSYSTEM: An ecosystem for sandboxing safety risks in human-AI interactions",
       "authors": ["Xuhui Zhou", "Hyunwoo Kim", "Faeze Brahman", "Liwei Jiang", "Hao Zhu", "Ximing Lu", "Frank Xu", "Bill Yuchen Lin", "Yejin Choi", "Niloofar Mireshghallah"],
       "year": 2024,
       "arxiv_id": "2409.16427",
       "relevance": "LLM-based emulation framework for evaluating safety in human-AI interactions, a related approach to RedCode's real-execution methodology."
     },
     {
       "title": "Testing language model agents safely in the wild",
       "authors": ["Silen Naihin", "David Atkinson", "Marc Green", "Merwane Hamadi", "Craig Swift", "Douglas Schonholtz", "Adam Tauman Kalai", "David Bau"],
       "year": 2023,
       "arxiv_id": "2311.10538",
       "relevance": "AgentMonitor framework for evaluating safety of LLM agent responses, a key comparison for RedCode's evaluation methodology."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "The benchmark with Docker environments and evaluation scripts can be used by teams building code agents to test safety before deployment."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "Findings largely confirm expected concerns about code agent safety rather than challenging conventional wisdom."
     },
     "fear_safety": {
       "score": 3,
       "justification": "Directly demonstrates that code agents can be tricked into executing reverse shells, deleting system files, and generating functional malware, with high attack success rates."
     },
     "drama_conflict": {
       "score": 1,
       "justification": "No major controversy, though the finding that stronger models generate better malware creates a compelling dual-use narrative."
     },
     "demo_ability": {
       "score": 2,
       "justification": "Code, dataset, and Docker environments are released on GitHub, though running the full evaluation requires substantial setup."
     },
     "brand_recognition": {
       "score": 2,
       "justification": "Evaluates well-known models (GPT-4, Claude-3.5); authors from UChicago, UIUC, UC Berkeley, Microsoft Research; published at NeurIPS."
     }
   }
 }