Security Debt of Agent-Generated Code

Sakib, Banik & Jadliwala (UTSA, arXiv 2607.12428): LLM-as-judge + manual coding over 16,112 high-risk file changes in 4,022 AIDev agentic PRs — 38.9% of agent PRs carry ≥1 security smell, supply-chain integrity (mutable action/image tags, unpinned installs) is 82.3% of them, GitHub Actions + Dockerfiles hold 87.6%, hard-coded credentials are 99.6% of critical smells, and flagging climbs with PR size from 16.2% to 53.6%. The two RQ2 surprises invert the usual story: *humans*, not agents, committed 67.6% of the 74 genuine leaked credentials, and 81.1% of them reached integration with no comment from any bot or human reviewer. There is no human-PR control group, so it measures the security posture of agent-assisted workflows, not an agent-vs-human delta