A Copilot agent completes a feature implementation task. All 47 unit tests and 12 integration tests in the CI pipeline pass. A security scan run as a separate, optional step later reveals that the agent introduced a SQL injection vulnerability in a new database query method. How should the agent evaluation framework classify this outcome?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Imagine a contractor who builds every room to spec and passes the final walkthrough — but drilled a hole through the fire wall to run a cable. Everything passes inspection except the one thing that burns the building down. The correct answer is B: a SQL injection vulnerability is a failure, full stop, no matter how many tests passed. Security regressions must be required gates in the evaluation pipeline, not afterthoughts.
Full explanation below image
Full Explanation
Agent evaluation frameworks must treat security outcomes with at least the same severity as functional outcomes — and in practice, higher. A SQL injection vulnerability can expose an entire database to exfiltration or destruction; a failing unit test cannot. When an agent introduces a critical security flaw, the classification must be unambiguous.
Why B is correct: Security vulnerabilities introduced by agent-generated code are objective failures. The evaluation framework should require security scanning as a mandatory gate — not optional or post-hoc — so that a security finding blocks the same way a failing test blocks. The fact that 59 tests passed is irrelevant: tests validate behavior against known inputs; they do not probe for injection attack surfaces. Making security scanning optional creates a process gap where agents can consistently pass 'evaluation' while systematically introducing exploitable code.
Why A is wrong: Classifying a SQL injection as a warning and scheduling a follow-up task treats a critical security regression as a minor quality issue. In a production system, this vulnerability could be exploited before the follow-up is addressed. The evaluation framework exists precisely to prevent such gaps from reaching production.
Why C is wrong: Proportional scoring that averages security findings against passing test counts is a dangerous anti-pattern. A single critical vulnerability has asymmetric impact — it can negate all the functional correctness in the world. Security findings are binary gates, not weighted averages.
Why D is wrong: This reasoning is the most dangerous option. SAST and dynamic security scanners detect vulnerability patterns that functional tests are structurally incapable of finding. A SQL injection vulnerability exists in how user input is concatenated into a query — functional tests typically use controlled, valid inputs, not adversarial injection payloads. Passing tests and being vulnerability-free are orthogonal properties. False positive rates for well-tuned security scanners on clear injection patterns are very low, and the right response to any security finding is investigation — not dismissal.