arXiv subjects

Obada Kraishan

Publications and source records attributed to Obada Kraishan.

8 recordsLinked to original sources

arXiv2026

Same Name, Different Server: A Security Census of Silent Drift in the Model Context Protocol Ecosystem

The Model Context Protocol (MCP) has become the common interface through which large language model applications reach external tools, and its public registry now distributes thousands of community-built servers with little of the vetting infrastructure that mature package ecosystems have accumulated. This paper reports a census of that ecosystem. We harvested the full public MCP registry (21,643 servers, 72,606 version records, August 2026 snapshot), fetched source code for 14,353 servers, and applied a pattern-based scanner covering an eight-class threat catalogue whose accuracy we measured against 414 hand-labeled findings. Observed prevalence is dominated by unauthenticated network exposure (9.57% of scanned servers); after correcting each class by its measured precision, 11.14% observed high-severity prevalence reduces to roughly 7.6%. The central finding concerns instability rather than any single weakness: 51.1% of multi-version servers changed what they advertise between versions, 40.6% did so silently, and 4.2% redirected their remote endpoint to a different host while keeping their registry identity, a change the protocol never surfaces to installed clients. Silent drift is associated with nearly threefold higher odds of a high-severity finding (OR = 2.96, 95% CI [2.56, 3.42]). Popularity offers only weak protection (OR = 0.78 per unit of log stars), so star counts are a poor proxy for safety. We derive concrete recommendations for registry design, client-side pinning, and scanner triage, and release an anonymized artifact.

cs.CR↗

arXiv2026

Not All Agents Are Equal: Code Quality and Post-Merge Maintenance Across Five Autonomous Coding Agents in the Wild

Autonomous coding agents now open pull requests in public repositories at a scale that was out of reach two years ago, yet little is known about what happens to that code after it lands. This paper studies 37,623 provenance-labeled pull requests (PRs) from five commercial agents (OpenAI Codex, Devin, GitHub Copilot, Cursor, and Claude Code) and a matched human baseline, drawn from 2,807 GitHub repositories between December 2024 and July 2025. We combine the AIDev dataset with 58,792 cached GitHub API responses to measure security smells in added code, structural maintainability, post-merge churn, revert rates, and human review behavior. Three results stand out. First, quality differences are vendor-specific rather than uniform: Codex-authored PRs were reverted about half as often as human PRs (6.1% vs. 11.5%, odds ratio 0.50), while Devin PRs were reverted more often (14.5%, odds ratio 1.31). Second, agent code pooled across vendors was less likely than human code to contain a security smell (odds ratio 0.63), driven by fewer hardcoded credentials and eval-style constructs. Third, review effort concentrates unevenly: Copilot PRs drew the most human reviews and change requests, and Claude Code PRs waited the longest for a first human review (median 12.6 hours). All pipeline code, statistical reports, and figures are released for replication.

cs.SE↗

arXiv2026

Plans They Abandon, Reports They Author: The Narrative Layer of Autonomous Agents

When a coding agent finishes a task, the developer reviews a summary the agent wrote about itself, not a display someone designed. We ask how much of the agent's work that summary carries, and whether it drifts toward the plan the agent stated when execution departed from it. Across 5,851 real developer sessions and 355,942 tool calls, a self-report referred to about one action in eleven, and a reader working from the report alone recovered roughly a fifth of the action log. Neither figure depended on whether the session later needed human correction. Reports did not generally resemble the stated plan more than the executed one, but they did so increasingly as execution diverged from the plan. We hand-validate both measurement steps that use a language model, report the one that failed alongside the one that passed, and draw conclusions only from measures that survived.

cs.HC↗

arXiv2026

Robo-Reporters: Evaluating Autonomous AI Agents as Algorithmic Gatekeepers in Computational Journalism

Artificial intelligence agents increasingly perform journalism tasks autonomously, searching for sources, evaluating credibility, and producing news content with minimal human oversight. Yet research has largely treated AI as a monolithic category, leaving the effects of architectural design unexamined. Drawing on gatekeeping theory, this study presents the first systematic comparison of four agent architectures, monolithic (Claude), chain-based (LangChain), multi-agent collaborative (CrewAI), and autonomous iterative (AutoGPT), across 200 controlled experiments spanning 50 journalism tasks of graduated difficulty. All architectures used the same underlying language model and identical tools, isolating architectural effects. Results revealed significant effects on task duration (F(3, 196) = 24.54, p < .001, eta-squared = .27) and computational strategy (F(3, 196) = 305.63, p < .001, eta-squared = .82), with architecture explaining 82% of the variance in processing behavior. Multi-agent collaboration achieved the highest accuracy (84.7%) at roughly twice the time cost of other designs. Multistage analysis of the monolithic architecture documented a 71.7% source rejection rate, a quantitative parallel to classic human gatekeeping, while framework-based systems obscured their filtering inside abstraction layers. Transparency emerged as an architectural choice: framework designs excelled at structured attribution, whereas monolithic and iterative designs produced superior methodological documentation. Findings position architecture as a new structural level of gatekeeping and offer evidence-based guidance for newsrooms: chain-based designs for speed, multi-agent for accuracy, monolithic for versatility, and iterative for auditability.

cs.CY↗

arXiv2026

The AI Invisibility Effect: Understanding Human-AI Interaction When Users Don't Recognize Artificial Intelligence

The fast integration of artificial intelligence into mobile applications has completely changed the digital landscape; however, the impact of this change on user perception of AI features remains poorly understood. This large-scale analysis examined 1,484,633 mobile application reviews across 422 applications (200 AI-featuring, 222 control) from iOS App Store and Google Play Store. By employing sentiment classification, topic modeling, and concern-benefit categorization, we identified a major disconnect: only 11.9% of reviews mentioned AI, even though 47.4% of applications featured AI capabilities. AI-featuring applications received significantly lower ratings than traditional applications (d = 0.40); however, hierarchical regression revealed a hidden pattern - the negative relationship reversed after controlling for AI mentions and review characteristics (b = 0.405, p < .001). Privacy dominated user concerns (34.8% of concern-expressing reviews), while efficiency represented the primary benefit (42.3%). Effects varied greatly by category, from positive for Assistant applications (d = 0.55) to negative for Entertainment (d = -0.23). These findings suggest that AI features often operate below user awareness thresholds, and it is the explicit recognition of AI, rather than its mere presence, that drives negative evaluations. This challenges basic assumptions about technology acceptance in AI systems.

cs.HC↗

arXiv2025

The AI Attribution Paradox: Transparency as Social Strategy in Open-Source Software Development

AI coding assistants have transformed software development, raising questions about transparency and attribution practices. We examine the "AI attribution paradox": how developers strategically balance acknowledging AI assistance with managing community scrutiny. Analyzing 14,300 GitHub commits across 7,393 repositories from 2023-2025, we investigated attribution strategies and community responses across eight major AI tools. Results reveal widespread AI usage (95.2% of commits) but strategic attribution: only 29.5% employ explicit disclosure, with dramatic tool variation (Claude 80.5% versus Copilot 9.0%). Explicit attribution triggers modest scrutiny (23% more questions and 21% more comments) but tool choice matters 20-30 times more for predicting reception. Community sentiment remains neutral regardless of attribution type, suggesting curiosity rather than hostility. Temporal analyses show rapid norm evolution: explicit attribution increased from near-zero in early 2024 to 40% by late 2025, indicating community adaptation. These findings illuminate attribution as strategic communication rather than simple transparency, advancing understanding of algorithmic accountability and norm formation during technological transitions. We discuss implications for developers navigating disclosure decisions, platforms designing attribution mechanisms, and researchers studying emergent practices in AI-augmented collaborative work.

cs.SE↗

arXiv2025

Launch-Day Diffusion: Tracking Hacker News Impact on GitHub Stars for AI Tools

Social news platforms have become key launch outlets for open-source projects, especially Hacker News (HN), though quantifying their immediate impact remains challenging. This paper presents a reproducible demonstration system that tracks how HN exposure translates into GitHub star growth for AI and LLM tools. Built entirely on public APIs, our pipeline analyzes 138 repository launches from 2024-2025 and reveals substantial launch effects: repositories gain an average of 121 stars within 24 hours, 189 stars within 48 hours, and 289 stars within a week of HN exposure. Through machine learning models (Elastic Net) and non-linear approaches (Gradient Boosting), we identify key predictors of viral growth. Posting timing appears as key factor--launching at optimal hours can mean hundreds of additional stars--while the "Show HN" tag shows no statistical advantage after controlling for other factors. The demonstration completes in under five minutes on standard hardware, automatically collecting data, training models, and generating visualizations through single-file scripts. This makes our findings immediately reproducible and the framework easily be extended to other platforms, providing both researchers and developers with actionable insights into launch dynamics.

cs.SI↗

arXiv2025

Emotional Contagion in Code: How GitHub Emoji Reactions Shape Developer Collaboration

Developer communities increasingly rely on emoji reactions to communicate, but we know little about how these emotional signals spread and influence technical discussions. We analyzed 2,098 GitHub issues and pull requests across 50 popular repositories, examining patterns in 106,743 emoji reactions to understand emotional contagion in software development. Our findings reveal a surprisingly positive emotional landscape: 57.4% of discussions carry positive sentiment, with positive emotional cascades outnumbering negative ones 23:1. We identified five distinct patterns, with "instant enthusiasm" affecting 45.6% of items--nearly half receive immediate positive reinforcement. Statistical analysis confirms strong emotional contagion (r=0.679, p<0.001) with a massive effect size (d=2.393), suggesting that initial reactions powerfully shape discussion trajectories. These findings challenge assumptions about technical discourse being purely rational, demonstrating that even minimal emotional signals create measurable ripple effects. Our work provides empirical evidence that emoji reactions are not mere decoration but active forces shaping collaborative outcomes in software development.

cs.HC↗