# A.S.E 2.0: Understanding How Repository Context Impacts the Security of LLM-Generated Code [Canonical reading](https://escapemeridian.com/readings/a-s-e-2-0-understanding-how-repository-context-impacts-the-9141a3d0) The authors of A.S.E 2.0 argue that the project files and code an LLM coding assistant sees can shape whether it generates secure code, not just code that works. They introduce CASE-Bench, a benchmark of repository-level tasks drawn from real CVEs, and compare context construction methods and controls across six LLMs. In their experiments, functionality-oriented context improved functional pass rates more than secure pass rates; removing a safeguard reduced secure pass rates, while adding one insecure example increased correct-but-exploitable code. The authors also report that coding agents saw the relevant safeguard in only 27–36% of trajectories. Their central concern is that context-building methods designed for functional correctness may leave security protections out of view or give models insecure code to imitate. The results point to repository context as a factor that secure-code evaluation and context construction need to account for. The abstract reports benchmark findings, not how these effects translate to code produced or deployed in other settings. Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims. ## Original source arXiv cs.AI · Article Original source date: Nov 4, 2026 (2026-11-04). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-10T00:08:08.784Z. First observed: 2026-11-05T05:00:35.387Z. Retrieved: 2026-11-09T14:23:00.199Z. - [A.S.E 2.0: Understanding How Repository Context Impacts the Security of LLM-Generated Code](https://arxiv.org/abs/2611.06294) ## Limits The supplied evidence is the paper abstract; it does not provide the full experimental methods or results. The reported findings come from CASE-Bench and the experiments described in the abstract; their applicability to other repositories or deployment settings is not established by this evidence. ## Open question How would the reported effects on secure pass rates change across repository tasks beyond the 145 in CASE-Bench? ## Source-stated The authors argue repository context can affect whether LLM-generated code is secure, because it determines whether the model sees safeguards or insecure code to imitate. > this context decides whether the model sees the project's safeguards (e.g., authorization checks) or insecure code to imitate. - [Supporting source](https://arxiv.org/abs/2611.06294) ## Source-stated The authors introduce CASE-Bench, a benchmark of 145 repository-level tasks from real CVEs in 51 projects. > We construct CASE-Bench, a benchmark of 145 repository-level tasks from real CVEs in 51 projects. - [Supporting source](https://arxiv.org/abs/2611.06294) ## Source-stated Across their experiments, functionality-oriented context raised functional pass rates by up to 8.2 percentage points and secure pass rates by at most 3.7 percentage points. > functionality-oriented context raises the functional pass rate by up to 8.2 percentage points (pp) but the secure pass rate by at most 3.7 pp - [Supporting source](https://arxiv.org/abs/2611.06294) ## Source-stated The authors report that withholding a safeguard lowered secure pass rates by up to 8.1 percentage points, while inserting one insecure exemplar raised correct-but-exploitable code by 6.3 percentage points. > withholding a safeguard lowers the secure pass rate by up to 8.1 pp, while one inserted insecure exemplar raises correct-but-exploitable code by 6.3 pp - [Supporting source](https://arxiv.org/abs/2611.06294) ## Source-stated The authors report that coding agents observed the relevant safeguard in 27–36% of trajectories. > coding agents observe the relevant safeguard in only 27-36% of trajectories. - [Supporting source](https://arxiv.org/abs/2611.06294) ## Source and contributor context Yu, Jiongchi, Lian, Keke, Wang, Junqing, Fan, Zhikang, Li, Zhaoxuan, Huang, Yongheng, Zhao, Ziming, Zhang, Dong · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Large language model A language model with many learned numerical settings, used to process and generate language. - [Definition reference](https://developers.google.com/machine-learning/glossary#large-language-model) ## Benchmark A defined set of tests used to compare systems. Results depend on the tasks and measures selected. - [Definition reference](https://arxiv.org/abs/2211.09110) ## Common Vulnerabilities and Exposures A list of publicly known cybersecurity vulnerabilities in which each entry has a unique identification number, a description and at least one public reference; it feeds the National Vulnerability Database. - [Definition reference](https://csrc.nist.gov/glossary/term/common_vulnerabilities_and_exposures) ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## Editorial provenance Version 1. Publication ID: adfd8c99-bf28-4ae4-82ea-7a2350833731. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: passed by anthropic/claude-opus-5.5 on 2026-11-10T00:08:08.784Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: 36b324c824ba10d3e516befa22d27a7a41ad258a83e394a14f03aa7fec07d601. Source text hash: 759863919eb6cf60525edd7db60cc48567f8ead4ebad052231ffe41f9d0140a3. ## Revision and source-check history ### Version 1 — 2026-11-10T00:08:08.784Z The authors of A.S.E 2.0 argue that the project files and code an LLM coding assistant sees can shape whether it generates secure code, not just code that works. They introduce CASE-Bench, a benchmark of repository-level tasks drawn from real CVEs, and compare context construction methods and controls across six LLMs. In their experiments, functionality-oriented context improved functional pass rates more than secure pass rates; removing a safeguard reduced secure pass rates, while adding one insecure example increased correct-but-exploitable code. The authors also report that coding agents saw the relevant safeguard in only 27–36% of trajectories. Their central concern is that context-building methods designed for functional correctness may leave security protections out of view or give models insecure code to imitate. The results point to repository context as a factor that secure-code evaluation and context construction need to account for. The abstract reports benchmark findings, not how these effects translate to code produced or deployed in other settings. ## Original source arXiv cs.AI · Article Original source date: Nov 4, 2026 (2026-11-04). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-10T00:08:08.784Z. First observed: 2026-11-05T05:00:35.387Z. Retrieved: 2026-11-09T14:23:00.199Z. - [A.S.E 2.0: Understanding How Repository Context Impacts the Security of LLM-Generated Code](https://arxiv.org/abs/2611.06294) ## Limits The supplied evidence is the paper abstract; it does not provide the full experimental methods or results. The reported findings come from CASE-Bench and the experiments described in the abstract; their applicability to other repositories or deployment settings is not established by this evidence. ## Open question How would the reported effects on secure pass rates change across repository tasks beyond the 145 in CASE-Bench? ## Source-stated The authors argue repository context can affect whether LLM-generated code is secure, because it determines whether the model sees safeguards or insecure code to imitate. > this context decides whether the model sees the project's safeguards (e.g., authorization checks) or insecure code to imitate. - [Supporting source](https://arxiv.org/abs/2611.06294) ## Source-stated The authors introduce CASE-Bench, a benchmark of 145 repository-level tasks from real CVEs in 51 projects. > We construct CASE-Bench, a benchmark of 145 repository-level tasks from real CVEs in 51 projects. - [Supporting source](https://arxiv.org/abs/2611.06294) ## Source-stated Across their experiments, functionality-oriented context raised functional pass rates by up to 8.2 percentage points and secure pass rates by at most 3.7 percentage points. > functionality-oriented context raises the functional pass rate by up to 8.2 percentage points (pp) but the secure pass rate by at most 3.7 pp - [Supporting source](https://arxiv.org/abs/2611.06294) ## Source-stated The authors report that withholding a safeguard lowered secure pass rates by up to 8.1 percentage points, while inserting one insecure exemplar raised correct-but-exploitable code by 6.3 percentage points. > withholding a safeguard lowers the secure pass rate by up to 8.1 pp, while one inserted insecure exemplar raises correct-but-exploitable code by 6.3 pp - [Supporting source](https://arxiv.org/abs/2611.06294) ## Source-stated The authors report that coding agents observed the relevant safeguard in 27–36% of trajectories. > coding agents observe the relevant safeguard in only 27-36% of trajectories. - [Supporting source](https://arxiv.org/abs/2611.06294) ## Source and contributor context Yu, Jiongchi, Lian, Keke, Wang, Junqing, Fan, Zhikang, Li, Zhaoxuan, Huang, Yongheng, Zhao, Ziming, Zhang, Dong · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Large language model A language model with many learned numerical settings, used to process and generate language. - [Definition reference](https://developers.google.com/machine-learning/glossary#large-language-model) ## Benchmark A defined set of tests used to compare systems. Results depend on the tasks and measures selected. - [Definition reference](https://arxiv.org/abs/2211.09110) ## Common Vulnerabilities and Exposures A list of publicly known cybersecurity vulnerabilities in which each entry has a unique identification number, a description and at least one public reference; it feeds the National Vulnerability Database. - [Definition reference](https://csrc.nist.gov/glossary/term/common_vulnerabilities_and_exposures) ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## Editorial provenance Version 1. Publication ID: adfd8c99-bf28-4ae4-82ea-7a2350833731. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: passed by anthropic/claude-opus-5.5 on 2026-11-10T00:08:08.784Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: 36b324c824ba10d3e516befa22d27a7a41ad258a83e394a14f03aa7fec07d601. Source text hash: 759863919eb6cf60525edd7db60cc48567f8ead4ebad052231ffe41f9d0140a3. ### passed — 2026-11-10T00:08:08.784Z — anthropic/claude-opus-5.5 Publication: adfd8c99-bf28-4ae4-82ea-7a2350833731 attribution — pass: The reading attributes the argument and findings to the A.S.E 2.0 paper's authors on arXiv. Results are framed as what the authors report, not as established fact. > Authors:Jiongchi Yu, Keke Lian, Junqing Wang, Zhikang Fan, Zhaoxuan Li, Yongheng Huang, Ziming Zhao, Dong Zhang summary — pass: The reading leads with the argument and plainly explains repository context as the project files and code the assistant sees. It conveys the mechanism (missing safeguards or imitable insecure code), the benchmark and the key results, and states the scope limit. The question follows from the 145-task scope. CVE, LLM and trajectories are not defined inline but are handled as exact technical terms for tooltips, which suits a general reader. > context construction is designed almost exclusively for functional correctness, and secure-code benchmarks treat the context as fixed date — pass: originalPublished 2026-11-04 matches the arXiv v1 submission date. It is not the later feed date of 2026-11-05. > \[Submitted on 4 Nov 2026\] support — pass: All numeric claims match the abstract: 145 tasks, 51 projects, six LLMs, 8.2 vs 3.7 pp, 8.1 pp, 6.3 pp and 27-36%. The significance statement mirrors the authors' own conclusion. The limitations correctly note that this evidence is the abstract alone and is confined to the benchmark. > These findings inform security-aware context construction and secure-code evaluation. media — pass: The selected media is the verified direct arXiv abstract page for this paper, which is the original source. ## Recorded references Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter. No public references recorded here yet. [Reference data (JSON)](/readings/9141a3d0d61c554609f440064d382311428c81244bc4c2d96896f975b5561f86/references.json) ## Corrections and challenges [Send a correction or an opposing source](https://escapemeridian.com/corrections/) [JSON record](https://escapemeridian.com/readings/a-s-e-2-0-understanding-how-repository-context-impacts-the-9141a3d0.json)