Poisoned ‘helpful’ patches
Statement (NASA form)
Given that maintainers already accept model-drafted fixes under time pressure, there is a possibility of a generated patch that closes a bug and opens a quieter one resulting in a widely used library shipping a backdoor-shaped mistake.
Plausible is not the same as correct. Reviewers stamp plausible.
Composite 15 = 3×4 + 3
Applicable mitigations
Controls · SAST and invariant tests as a merge gate on generated diffs · Provenance tags on generated code in the review UI · Diversity requirements on critical paths · Short-lived, narrowly scoped tokens for every tool call · Mandatory secret scanning before a skill can be listed · No shared tool state across agent sessions · Staged release with external red-team gates · Mandatory vulnerability-sharing with national CERTs before launch