VT Verification & trust
Evals, testing agent output, benchmarks, security, governance and guardrails.
From the issues
Foresight-SWE: the agent passes your tests and plants next month's bug
Mostly no. In Foresight-SWE, a Princeton and NYU benchmark of 212 real pull-request pairs, 11 models resolved 60.68% of tasks on average but avoided the bug someone later fixed only 14.84% of the time. Told about the defect, five models fixed it 91.23% of the time. Ask every review what someone will fix next.
99% on the Exam Isn't 99% on the Job
No. A benchmark getting solved is not coding getting solved. When SWE-Bench Pro was audited, 480 of 731 tasks had to be repaired or retired, and the cleaned V2 set still tops out at 99.4% while its Hard split spreads from 52.9% to 98.0%. Read every score with its protocol attached.
Slop Is Whatever Passes: the AI junk worth worrying about isn't the kind you can spot
AI slop in code is output that never met a check that could fail it. In the TestJack audit, 34.4% of agent runs that passed evaluation broke the task's own requirements. Audit your tests and judges the way you audit the agent, and report a checker error rate next to every pass rate.
The invented package is only harmless until someone registers it
No. A made-up package fails to install only until someone registers the name. Models repeat their inventions: 43% of hallucinated names came back in all 10 runs, and five 2026 frontier models invented the same 127. Install from a lockfile, and put an age check in front of any package the repo has never seen.
The Approve button is a receipt for the wrong thing
No. A human approving each command doesn't make a coding agent safe, because the risk sits in what the command sets off. In 40 of 111 approval records studied, the fields a human sees left effects uncovered. Sandboxes and effect checks do the protecting. The click is just a receipt.
Numbers on this track
| Number | What it measures | Source | Checked | Track · issue |
|---|---|---|---|---|
| 40 of 111 | Agent approval records where the fields a human sees left effects uncovered | Agent Approval Laundering, arXiv:2609.28586 | ✓verified at source | VTVerification & trust Issue #01 |
| 34.4% | Share of agent runs judged correct that violated the task's own requirements (6 frontier models, 5 agentic coding benchmarks) | Yao et al., TestJack, arXiv:2610.10619 | ✓verified at source | VTVerification & trust Issue #02 |
| 50.6% → 33.2% | Overall resolution rate before and after fixing the evaluators | Yao et al., TestJack, arXiv:2610.10619 | ✓verified at source | VTVerification & trust Issue #02 |
| 1,154 | Reddit and Hacker News posts coded in a study of AI slop in software development | Baltes, Cheong and Treude, arXiv:2603.27249 | ✓verified at source | VTVerification & trust Issue #02 |
| 28 (24 / 2) | Verifier defects found in ReviveBench: 24 false negatives, 2 false positives | Liu et al., ReviveBench, arXiv:2609.36161 | ✓verified at source | VTVerification & trust Issue #02 |
| 43.1% | Applicable project policies violated by agents even when patches were functionally correct | Truong et al., SWE-CC, arXiv:2610.06193 | ✓verified at source | VTVerification & trust Issue #02 |
| 11.2% to 58.7% | Runs with unnecessary defensive work despite explicit evidence it wasn't needed | Luo et al., ParanoiaEval, arXiv:2610.08662 | ✓verified at source | VTVerification & trust Issue #02 |
| 19.7% | Generated packages that were hallucinated, across 16 models on 2024-era models (at least 5.2% commercial, 21.7% open-source) | Spracklen et al., arXiv:2406.10279 (v3) | ✓verified at source | VTVerification & trust Issue #02 |
| 43% / 58% / 39% | Hallucinated packages repeated in all 10 runs / more than once / never repeated | Spracklen et al., arXiv:2406.10279 (v3) | ✓verified at source | VTVerification & trust Issue #02 |
| 4.62% to 6.10% | Package hallucination rates on five 2026 frontier models | Churilov, arXiv:2605.17062 | ✓verified at source | VTVerification & trust Issue #02 |
| 127 | Package names all five 2026 models invented identically (109 on PyPI, 18 on npm) | Churilov, arXiv:2605.17062 | ✓verified at source | VTVerification & trust Issue #02 |
| 480 of 731 | SWE-Bench Pro tasks repaired or retired by 23 engineers in 404 hours | Dan et al., SWE-Bench Pro V2, arXiv:2610.24206 | ✓verified at source | VTVerification & trust Issue #03 |
| 99.4% | Best resolution rate by frontier agents on the 642 SWE-Bench Pro V2 tasks | Dan et al., SWE-Bench Pro V2, arXiv:2610.24206 | ✓verified at source | VTVerification & trust Issue #03 |
| 52.9% to 98.0% | Spread of systems on the 51-task Hard split of SWE-Bench Pro V2 | Dan et al., SWE-Bench Pro V2, arXiv:2610.24206 | ✓verified at source | VTVerification & trust Issue #03 |
| 60.68% vs 14.84% | Average task resolve rate against average foresight rate (avoiding the bug a later PR fixed), 11 models, 212 PR pairs | Patel et al., arXiv:2611.01181 | ✓verified at source | VTVerification & trust Issue #04 |
| 91.23% vs 19.91% | How often five models fixed the later bug when it was described, against when it was unstated | Patel et al., arXiv:2611.01181 | ✓verified at source | VTVerification & trust Issue #04 |
Papers on this track
- Agent Approval Laundering: Transitive Effects Beyond the Approved Invocation arXiv:2609.28586
- "An Endless Stream of AI Slop": How Developers Discuss the Burden of AI-Assisted Software Development arXiv:2603.27249
- TestJack: Should you trust the results in coding benchmarks? Agentic Coding Benchmarks Auditing via Evaluator Evolution arXiv:2610.10619
- From Dead Code and Static Requirements to Working Engines: Software Revival with Coding Agents arXiv:2609.36161
- Correct Code, Broken Contributions? SWE-CC: Benchmarking Repository Policy Compliance for Coding Agents arXiv:2610.06193
- ParanoiaEval: Benchmarking Unnecessary Defensive Work in Agentic Coding arXiv:2610.08662
- We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs arXiv:2406.10279
- The Range Shrinks, the Threat Remains: Re-evaluating LLM Package Hallucinations on the 2026 Frontier-Model Cohort arXiv:2605.17062
- SWE-Bench Pro V2: A Cleaner, Harder-to-Game Coding Benchmark arXiv:2610.24206
- Foresight-SWE arXiv:2611.01181
Other tracks
ISIntent & specs CKContext & knowledge ABAgents that build UMUnderstanding & modernisation POPeople & operating model
Last updated . Reuse with credit under CC BY 4.0: “The Dabbawala Protocol, thedabbawalaprotocol.com”.