The increasing adoption of large language models (LLMs) in software engineering necessitates rigorous security evaluation of their generated code. However, existing benchmarks often lack relevance to real-world AI-assisted programming scenarios, making them inadequate for assessing the practical security risks associated with AI-generated code in production environments. To address this gap, we introduce A.S.E (AI Code Generation Security Evaluation), a repository-level evaluation benchmark designed to closely mirror real-world AI programming tasks, offering a comprehensive and reliable framework for assessing the security of AI-generated code. Our evaluation of leading LLMs on A.S.E reveals several key findings. In particular, current LLMs still struggle with secure coding. The complexity in repository-level scenarios presents challenges for LLMs that typically perform well on snippet-level tasks. Moreover, a larger reasoning budget does not necessarily lead to better code generation. These observations offer valuable insights into the current state of AI code generation and help developers identify the most suitable models for practical tasks. They also lay the groundwork for refining LLMs to generate secure and efficient code in real-world applications.

Autonomous LLM agents are increasingly deployed in complex environments as tool-using systems. However, their safety remains fragile, as minor reasoning or retrieval errors can be amplified into hazardous actions within the agentic workflow. Existing defenses, often limited to static prompts or post-hoc guardrails, fail to provide runtime intervention or cross-architecture portability. In this paper, we propose Safety Sidecar, a model-agnostic, plug-and-play module designed to provide standardized runtime safety control and auditability for arbitrary agent workflows. Safety Sidecar operationalizes reflection as a closed-loop controller: it dynamically monitors decision traces, retrieves evidence-based repair exemplars from a reflective memory, and enforces risk-mitigating revisions before execution. Crucially, it employs external verifiers to gate both action release and memory updates, producing a transparent, auditable trail of retrieved evidence and applied constraints.We instantiate and systematically evaluate Safety Sidecar in secure code generation—a high-stakes domain with objective vulnerability signals. Experimental results across eight CWE scenarios and four representative LLMs demonstrate that Safety Sidecar consistently improves the secure-solution rate by 2.9–11.2 percentage points while maintaining competitive functional correctness. Efficiency analysis shows the framework is practical for deployment, with reflection adding only 3.2s to end-to-end latency and a negligible average cost of 5.37 × 10^-4 per scenario. Our findings position Safety Sidecar as a portable and efficient control layer for enhancing the safety, compliance, and auditability of LLM-based agents.

Safe and reliable large language models should abstain when a question falls beyond their knowledge boundary. Existing abstention methods often use prompt-level uncertainty signals, such as semantic entropy or sampling consistency, as proxies for this boundary, treating instability under the current prompt as evidence that the question is unanswerable. We argue that this prompt-level view is overly conservative: the same underlying question can exhibit different stability under different formulations, and high uncertainty under one prompt may indicate that the answer has not been stably reached rather than that the model lacks the relevant knowledge. We propose a test-time question-level probing framework that uses existing prompt-level uncertainty signals rather than introducing a new uncertainty metric. When the original prompt is unstable, the framework probes semantically equivalent reformulations and accepts an answer only when multiple stable views provide consistent low-entropy evidence. This observable behavior serves as an operational proxy for question-level answerability under a fixed model, sampling configuration, and reformulation set. The method requires no target-model training or parameter updates and is compatible with semantic entropy and its variants. Experiments show that question-level probing recovers prompt-sensitive answers incorrectly rejected by prompt-level methods and improves the risk-coverage trade-off with controlled error rates. The code is available at https://github.com/Narwhal-Lab/Narwhal-codegen-safety-hub/tree/main/KnowledgeBoundariesAreNotDefinedByPrompts.