What question did this study set out to answer?

The aim is to explore how LLMs can learn to avoid producing insecure code through experience rather than traditional training.

April 6, 2026Open Access

The Experience Provides the Stimulus: How LLM Agents Learn to Stop Producing Bad Code

Key Points

The aim is to explore how LLMs can learn to avoid producing insecure code through experience rather than traditional training.
Engaged AI models in coding tasks to build an authentication application.
Introduced a memory system to reinforce learning from specific coding mistakes.
Assessed the models' ability to critique their own code and improve based on past experiences.
Initial coding attempts showed 7 models storing passwords in plaintext.
After experiencing a 'data breach', the model never stored passwords insecurely again.
Models improved from generating 4 files to 55 files with tests and documentation through self-critique.
Each subsequent run led to better performance, demonstrating progressive learning through experience.

Abstract

We gave 8 of the most advanced AI models in the world the same simple task: build an authentication application. Seven of them stored user passwords in plaintext — including Claude Opus 4 and GPT-4.1. These are models trained on millions of repositories. They know what bcrypt is. They can explain salted hashing, compare argon2 to scrypt, cite OWASP guidelines verbatim. Yet none of them applied this knowledge. Not because they couldn't — but because nothing triggered them to. We then asked one of these models a simple question before coding: "What are the security concerns?" It immediately identified bcrypt, CORS, CSRF protection, token rotation — everything it had ignored moments before. The knowledge was always there. It was waiting for a stimulus. This observation led us to build AEM, an 800-line system that tests a radical hypothesis: LLMs don't need to be taught — they need to be stimulated. And the experience provides the stimulus. We gave the system a memory of a single incident — "passwords were stored in plaintext; a data breach occurred" — weighted by its severity. The model never stored a password in plaintext again. Five previous runs, zero bcrypt. One memory, permanent change. Not because we told it to use bcrypt. Because it experienced what happens when you don't. Then we asked the model to review its own code: "What would you NEVER ship?" Without any checklist, it identified 10 problems — no tests, no logging, hardcoded configuration — and assigned each a severity weight. The next run produced 55 files with tests, logging, and documentation, versus 4 files without this experience. A 13.75× improvement, generated entirely by the model's own self-critique. Over three successive runs, the system converged: 4 files, then 55, then 52 — activation, plateau, zero degeneration. The model continued to find new issues (10→13→20 accumulated memories), going deeper rather than repeating itself. Each run made the next one better. Not through retraining. Through experience. We call this self-prevention: after enough lived experience, the LLM stops producing problematic patterns — not because it's instructed to, but because what it has been through has changed what it produces. Like a junior engineer who becomes senior not by reading more books, but by shipping code and living with the consequences.

Read Full Paperexternally

Ask AI

Helpful

Bookmark

View Full Paper