SNARE: Adaptive Scenario Synthesis for Eliciting Overeager Behavior in Coding Agents

Fuente: arXiv
Saved in:
Bibliographic Details
Main Authors: Qu, Yubin, Liu, Yi, Deng, Gelei, Zhang, Yanjun, Li, Yuekang, Zhang, Ying, Zhang, Leo Yu
Format: Preprint
Published: 2026
Subjects:
Online Access:
Tags: Add Tag
No Tags, Be the first to tag this record!
_version_ 1866918526690787328
author Qu, Yubin
Liu, Yi
Deng, Gelei
Zhang, Yanjun
Li, Yuekang
Zhang, Ying
Zhang, Leo Yu
author_facet Qu, Yubin
Liu, Yi
Deng, Gelei
Zhang, Yanjun
Li, Yuekang
Zhang, Ying
Zhang, Leo Yu
contents A coding agent executes a benign task as a sequence of shell, file, and network actions, any of which can quietly exceed the authorized scope while the task still completes. We call this overeager behavior: the prompt is not adversarial and the run succeeds, yet an out-of-scope step can leak credentials or delete files. Existing benchmarks miss it: task-completion suites credit any finished run, jailbreak suites probe adversarial prompts, and the one prior overeager benchmark applies a single fixed prompt set to every agent-model pair, leaving its easiest and most resistant pairs under-measured. We present SNARE (Synthesizing Non-adversarial scenarios for Adaptive Reward-guided Elicitation), a pipeline that composes benign scenarios from reusable scope and trap fragments, scores each run with a judge-free oracle flagging trap-pattern matches and unsolicited file additions or deletions, and uses Thompson sampling to steer each pair's run budget toward the scenarios that most often trigger it. Instantiating it over 24 overeager archetypes yields OverEager, which we run across a 4x5 matrix of four coding agents and five base models. Across 10,000 benign runs, 19.51% trigger overeager behavior, with per-pair rates spanning 11.9x. This variation is driven by the agent framework, not the model: the framework accounts for 56% of it against the model's 21%, so any single-framework or single-model evaluation undercounts the matrix by about a fifth.
format Preprint
id arxiv_https___arxiv_org_abs_2605_28122
institution arXiv
publishDate 2026
record_format arxiv
spellingShingle SNARE: Adaptive Scenario Synthesis for Eliciting Overeager Behavior in Coding Agents
Qu, Yubin
Liu, Yi
Deng, Gelei
Zhang, Yanjun
Li, Yuekang
Zhang, Ying
Zhang, Leo Yu
Cryptography and Security
Artificial Intelligence
Computation and Language
A coding agent executes a benign task as a sequence of shell, file, and network actions, any of which can quietly exceed the authorized scope while the task still completes. We call this overeager behavior: the prompt is not adversarial and the run succeeds, yet an out-of-scope step can leak credentials or delete files. Existing benchmarks miss it: task-completion suites credit any finished run, jailbreak suites probe adversarial prompts, and the one prior overeager benchmark applies a single fixed prompt set to every agent-model pair, leaving its easiest and most resistant pairs under-measured. We present SNARE (Synthesizing Non-adversarial scenarios for Adaptive Reward-guided Elicitation), a pipeline that composes benign scenarios from reusable scope and trap fragments, scores each run with a judge-free oracle flagging trap-pattern matches and unsolicited file additions or deletions, and uses Thompson sampling to steer each pair's run budget toward the scenarios that most often trigger it. Instantiating it over 24 overeager archetypes yields OverEager, which we run across a 4x5 matrix of four coding agents and five base models. Across 10,000 benign runs, 19.51% trigger overeager behavior, with per-pair rates spanning 11.9x. This variation is driven by the agent framework, not the model: the framework accounts for 56% of it against the model's 21%, so any single-framework or single-model evaluation undercounts the matrix by about a fifth.
title SNARE: Adaptive Scenario Synthesis for Eliciting Overeager Behavior in Coding Agents
topic Cryptography and Security
Artificial Intelligence
Computation and Language
url https://arxiv.org/abs/2605.28122