SCGAgent: Recreating the Benefits of Reasoning Models for Secure Code Generation with Agentic Workflows
Fuente:
arXiv
Salvato in:
| Autori principali: | , , , |
|---|---|
| Natura: | Preprint |
| Pubblicazione: |
2025
|
| Soggetti: | |
| Accesso online: | |
| Tags: |
Aggiungi Tag
Nessun Tag, puoi essere il primo ad aggiungerne!!
|
| _version_ | 1866918050486288384 |
|---|---|
| author | Saul, Rebecca Wang, Hao Sen, Koushik Wagner, David |
| author_facet | Saul, Rebecca Wang, Hao Sen, Koushik Wagner, David |
| contents | Large language models (LLMs) have seen widespread success in code generation tasks for different scenarios, both everyday and professional. However current LLMs, despite producing functional code, do not prioritize security and may generate code with exploitable vulnerabilities. In this work, we propose techniques for generating code that is more likely to be secure and introduce SCGAgent, a proactive secure coding agent that implements our techniques. We use security coding guidelines that articulate safe programming practices, combined with LLM-generated unit tests to preserve functional correctness. In our evaluation, we find that SCGAgent is able to preserve nearly 98% of the functionality of the base Sonnet-3.7 LLM while achieving an approximately 25% improvement in security. Moreover, SCGAgent is able to match or best the performance of sophisticated reasoning LLMs using a non-reasoning model and an agentic workflow. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2506_07313 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | SCGAgent: Recreating the Benefits of Reasoning Models for Secure Code Generation with Agentic Workflows Saul, Rebecca Wang, Hao Sen, Koushik Wagner, David Cryptography and Security Large language models (LLMs) have seen widespread success in code generation tasks for different scenarios, both everyday and professional. However current LLMs, despite producing functional code, do not prioritize security and may generate code with exploitable vulnerabilities. In this work, we propose techniques for generating code that is more likely to be secure and introduce SCGAgent, a proactive secure coding agent that implements our techniques. We use security coding guidelines that articulate safe programming practices, combined with LLM-generated unit tests to preserve functional correctness. In our evaluation, we find that SCGAgent is able to preserve nearly 98% of the functionality of the base Sonnet-3.7 LLM while achieving an approximately 25% improvement in security. Moreover, SCGAgent is able to match or best the performance of sophisticated reasoning LLMs using a non-reasoning model and an agentic workflow. |
| title | SCGAgent: Recreating the Benefits of Reasoning Models for Secure Code Generation with Agentic Workflows |
| topic | Cryptography and Security |
| url | https://arxiv.org/abs/2506.07313 |