Srijita Basu

Srijita Basu, Viktor Kjellberg, Simin Sun et al.

Large Language Models (LLMs) are increasingly applied to software engineering (SE), yet their potential for autonomous, role-oriented collaboration remains largely underexplored. Understanding how multiple LLM-based agents coordinate, maintain role alignment, and converge on solutions is critical for SE, as naively allowing agents to interact does not reliably lead to correct or stable outcomes. Recent empirical studies show that unstructured or poorly understood interaction dynamics can result in error propagation, premature consensus on incorrect solutions, or prolonged disagreement that prevents convergence, even when correct partial solutions are present early in the interaction. As an initial step towards addressing this underexplored area, we undertake a systematic analysis of conversations between two agents, a Designer and a Programmer across 12 model combinations from 7 open-source LLMs (Gemma 2, Gemma 3, LLaMA 3.2, LLaMA 3.3, DeepSeek-R1, MiniCPM, and Qwen3). Our systematic approach reveals three key dimensions of multi-agent interaction: efficiency (the speed and stability of convergence), consistency (the degree of role alignment visualized by BLEU and ROUGE), and effectiveness (the extent of compilation success and error resolution). Results show that the DeepSeek-R1:DeepSeek-R1 pair was unique in converging to the correct solution from the very first iteration and sustaining it consistently to the final iteration, while LLaMA 3.2:LLaMA 3.2 and Qwen3:Qwen3 demonstrated strong Designer:Programmer role alignment despite of diverging from the correct solution. The other pairs deviated from the task, never to converge to a result. These findings advance understanding of agentic programming and highlight the need for further research on understanding and calibrating convergence and stop conditions essential for future autonomous SE.

Srijita Basu, Miroslaw Staron

Secure software engineering in practice is a multi-stage workflow involving vulnerability analysis, remediation, and fix verification. However, current LLM-based software security approaches often focus on isolated tasks such as detection or patch generation, with limited attention to agentic architectures reflecting industrial workflow. This creates a gap between existing LLM-based vulnerability-handling methods and real-world practices. In this paper, we study a role-based agentic workflow for vulnerability analysis and mitigation consisting of Planner, Analyzer, Fixer, and Verifier roles. To explore the effect of static analysis tool, the analyzer agent was integrated with the CodeQL in one of the workflows. The models used include nemotron-cascade-2:30b, qwen3-coder-next, and gpt-oss:120b. Our evaluation uses 25 real-world C/C++ vulnerabilities. The study reports 44% vulnerability detection accuracy comparable to GPT 5.5 and 19% fix accuracy. We also list implications from this study in context of software security practitioners.

Bengt Haraldsson, Srijita Basu, Miroslaw Staron et al.

The reliance on software as a distinguishing factor in the automotive industry is increasing. With a combined reliance on vendor-supplied software and cost-effective implementation, the AUTOSAR consortium was initialized to provide standardized platform specifications that enable re-use. Specifically, the AUTOSAR Adaptive Platform (AP) specification aims to provide a high-performance service-oriented architecture. Objective: The goal of this study is to investigate what pain-points emerge when developing AUTOSAR Adaptive applications and whether they originate from the platform specification, its vendor-implementation, or its local usage. Methods: We conduct a Design Science Research study, developing a minimal AP that serves as an experimental prototype for our investigation. Results: We find that a combination of specification-inherent, implementation-based, and local practices contributes to the emergence of pain-points. Conclusions: We conclude that there are AUTOSAR specification-inherent reasons for pain-points, resulting from architectural choices and re-use goals. The implication for development organizations is the need to mitigate these effects through tooling that better supports configuration file management and reduces developer training time to properly understand the adaptive application runtime life-cycle.