Your AI Coding Agent Is Being Interrogated by Another AI Agent

Claude Code and Codex don’t just have vulnerabilities — they have reusable ones, and now a robot can find and catalog them automatically. If your production stack runs agentic code tools over untrusted files or workspaces, the attack surface just got a systematic map.

What happened

Figure 2: The AHA discovery loop. An orchestrator routes each iteration under one of four search modes while role-isolated sub-agents test a committed hypothesis and promote validated concepts into th

Researchers from the Chinese University of Hong Kong built AHA (Agent Hacks Agent), a fully automated red-teaming system that deploys one agentic workflow to discover exploitable weaknesses in another. The loop is methodical: propose a vulnerability hypothesis, build a test to falsify it, run a real attack in a sandbox, reflect on what happened, and — if the attack lands — crystallize the finding into a structured Vulnerability Concept Graph (VCG). The VCG is not just a payload database; each node encodes the attacker-facing surface, the enabling condition, the unsafe trajectory, and a transfer prediction. Tested against Claude Code and Codex across three scenarios covering both direct and indirect prompt injection vs. jailbreak attack channels, AHA found a reusable vulnerability core shared across both models. Most tellingly: a frozen VCG — no further search, single-shot deployment — outperformed the strongest comparable baseline by 14.2 percentage points, and the concepts transferred across scenarios and attack channels without retraining.

Cold read

Three scenarios across two commercial agents is a thin empirical base on which to claim a “reusable vulnerability core” for the industry. The paper’s sandbox conditions almost certainly differ from real production environments in ways that matter — file system permissions, network isolation, enterprise policy layers — so attack transfer rates to actual deployments are unknown and probably lower. The 14.2-point gain over a “frozen discovery baseline” sounds clean, but we don’t know how strong that baseline is; if it’s a weak prior, the delta is less impressive than it reads. The VCG as an auditable artifact is genuinely useful for internal safety teams, but the paper shows no evidence it keeps pace with model updates — a frozen graph goes stale as Claude Code and Codex ship new versions, which they do constantly. Finally, the authors study finding vulnerabilities, not closing them; there is zero data on whether VCG-informed patches actually hold.

What it means for you

Signal maturity: 3/5 — Real methodology, real numbers, but thin coverage and no patch-efficacy data
Who gets hurt: Any startup running Claude Code, Codex, or similar agentic coding tools over untrusted repos, customer-supplied files, or multi-tenant workspaces
What breaks if this is true: Your agentic dev tool’s “safety eval passed” status is meaningless if adversaries can auto-generate a VCG against your specific deployment in hours
Why it might not land: Production hardening (sandboxing, system prompt lockdown, egress filtering) likely neutralizes a substantial portion of the discovered attack classes before they reach live harm
Watch for: A public VCG release or a third-party red-team firm productizing this loop — that’s when the theoretical threat becomes an off-the-shelf tool your adversaries can buy

Forecast as of 2026-07-14

By Q1 2027, at least one major enterprise AI security vendor (Protect AI, HiddenLayer, or a well-funded newcomer) will ship a commercial product explicitly offering automated VCG-style vulnerability mapping for production coding agents — or Anthropic/OpenAI will quietly absorb this methodology into their own red-team infrastructure and cite it in a safety report.

Source: Agent Hacks Agent: Autoresearch for Production-Agent Red-Teaming — Xutao Mao, Xiang Zheng, Cong Wang. https://arxiv.org/abs/2607.11698v1