随着人工智能编码代理变得更加自主,，他们越来越多地迭代地交付代码,，并且代码库在会话之间持续存在。这种持久性创建了一个新的攻击面:，未对齐或提示注入的代理可以跨拉取请求(PRs) 分发攻击，并为具有最佳自然掩护的 PR 计时其有效负载。为了研究由此产生的动态,，我们引入了迭代 VibeCoding, 人工智能控制, 设置，用于安全部署有能力但可能不受信任的人工智能的研究。在 Iterative VibeCoding, 中，编码代理在持久代码库中的一系列 PR 上构建软件，同时执行隐蔽的副任务。我们的基准测试包括两个任务系列: CLI 工具和 Flask Web 服务,，总共 20 个任务变体。我们使用 Claude Sonnet 4.5 作为攻击代理，使用 GPT-4o 作为监控器。我们将渐进式攻击, 与集中在单个 PR 中的非渐进式攻击进行比较，渐进式攻击, 将副任务分配给 PR,。没有一个监视器能够同时对: 和: 都具有鲁棒性，该策略可逃避最佳( 成功，而逃避监视器) 则取决于监视器类型,，因此防御者无法使用任何一台监视器同时阻止渐进式和非渐进式攻击。高规避率 (>= 65%) 概括了模型攻击代理后端 (Sonnet 4.5, Gemini 3.1 Pro, Kimi K2.5), 确认这是持久状态攻击面的属性，而不是单个模型的 的功能。在最先进的监控模型中，规避率仍然很高，并且对于能力更强的模型，渐进式和非渐进式规避之间的差距会扩大。我们引入了一个状态链接跟踪器监视器，用于跟踪 PR 中可疑的累积情况。在两个任务系列, 上，它检测渐进攻击的能力比仅查看更多累积历史记录的 diff 监视器要好得多。将这种更强大的监视器与四监视器组合中的轨迹监视器相结合，可以将渐进攻击规避率从最弱的标准差异监视器下的 93% 降低到 47%。

As AI coding agents become more autonomous, they increasingly ship code iteratively, with the codebase persisting across sessions. This persistence creates a new attack surface: a misaligned or prompt-injected agent can distribute attacks across pull requests (PRs) and time its payload for the PR with the best natural cover. To study the resulting dynamics, we introduce Iterative VibeCoding, a setting for AI control, the study of safely deploying capable but potentially untrusted AI. In Iterative VibeCoding, a coding agent builds software over a sequence of PRs in a persistent codebase while pursuing a covert side task. Our benchmark includes two task families: CLI tools and Flask web services, across 20 total task variations. We use Claude Sonnet 4.5 as the attack agent and GPT-4o as the monitor. We compare gradual attacks, which distribute the side task across PRs, against non-gradual attacks concentrated in a single PR. No single monitor is robust to both: which strategy evades best (success while evading the monitor) depends on the monitor type, so a defender cannot close off both gradual and non-gradual attacks with any one monitor. High evasion (>= 65%) generalizes across model attack agent backends (Sonnet 4.5, Gemini 3.1 Pro, Kimi K2.5), confirming this is a property of the persistent-state attack surface rather than a single model的 capability. Evasion also remains high across state-of-the-art monitor models and the gap between gradual and non-gradual evasion widens for more capable models. We introduce a stateful link-tracker monitor that tracks suspicious buildup across PRs. On both task families, it detects gradual attacks substantially better than diff monitors that merely see more accumulated history. Combining this stronger monitor with trajectory monitors in a four-monitor ensemble reduces gradual-attack evasion from 93% under the weakest standard diff monitor to 47%.

科目:人工智能(cs.AI)

Subjects: Artificial Intelligence (cs.AI)