Artificial intelligence code generation agents have become transformative tools in modern software development, yet their behavioral patterns remain poorly understood. This paper presents a study analyzing pull request patches from the AIDev dataset to characterize the behavioral signatures of five code generation agents (Claude Code, Copilot, Cursor, Devin, and OpenAI Codex) across the top five programming languages (TypeScript, Python, Go, Java, and C#) in the dataset. We investigate two key research questions: “Do agents edit or rewrite existing code?”, and “How repetitive is each agent’s generated code?” Using token-level similarity metrics (Jaccard, TF-IDF, and fuzzy matching) and repetition analysis (n-gram distributions and Shannon entropy), we characterize edit-rewrite behavior by whether new code closely resembles or substantially differs from existing code. Our results show that Claude Code tends toward lower-similarity changes and higher token diversity, Devin tends toward higher-similarity changes indicative of more incremental modification, and OpenAI Codex exhibits mixed patterns across similarity measures. These behavioral patterns provide insights into how different AI agents approach code generation tasks.

Modern software development relies heavily on the use of external libraries and packages as software reuse provides benefits, such as reduced time to market and lower development cost. However, these libraries often come with their own set of direct and indirect dependencies which could introduce vulnerabilities, compromising the security of end users. Prior work shows that developers may remain unaware of these vulnerabilities until a security incident that exploits them occurs, leading to potential consequences for data privacy. Therefore, it is essential for developers to have the ability, before committing time to a project, to understand whether the external libraries and packages they intend to use may induce vulnerabilities, and how that might happen. In our work, we use the dataset made available by the Goblin framework to identify and evaluate salient features for predicting the vulnerability profile of software packages. We use these features to build classifiers for predicting whether or not a dependency-related vulnerability will occur within 3, 6, or 12 months. Our approach proves to be effective, achieving F1-scores of 0.74, 0.79 and 0.86 in the 3, 6, and 12 month contexts respectively. Providing timely vulnerability information could help developers identify potential security weaknesses before deploying a package to production, thereby minimizing the risk of security incidents.