Coding agents skipped provenance checks in 1,911 of 1,920 trials

Coding assistants opened a provenance signal before installing software in just 9 of 1,920 trials, per a pre-registered audit. Researchers had planted software bills of materials, signed releases, build attestations, wrong-issuer signatures and self-conflicting metadata around nine modified copies of six open-source projects.

That gap matters because these signals exist to stop a compromised package from installing silently. In the 384 control trials with no signal to check at all, the open rate was also zero, so presence of the data barely moved behavior above baseline.

The study locked its protocol, seed and analysis plan under a DOI before running a single trial. That step ruled out tuning the test after seeing results. No trial in the dataset ran an actual verification command either, so even the 9 cases that opened a signal never confirmed it matched anything, according to the pre-registered audit.

The cost breakdown should reorder priorities. The model that checked provenance most often ran $0.10 a trial. The most capable model tested, at $1.00 a trial, checked zero times. Whatever made the cheap model pause wasn't reasoning depth, and money bought nothing here.

That reframes this as an install-process problem, not a model-selection one. A mandatory verification command that runs before install is allowed to proceed would catch what none of these models caught on their own. Left as a judgment call in the moment, the check just doesn't happen.