Prefixing function names with 'secure_' nudges agents toward safer code
Researchers ran a three-step API-building task with coding agents, varying only the prefix on four initial function names: secure_, safe_, energetic_, lazy_, unsafe_, control.
All three runs with the secure_ prefix added password fields and bcrypt hashing unprompted. Zero other conditions (15 runs total) did so, despite identical downstream prompts.
A single word prepended to function names reliably shifted the agent's reasoning toward security—no architectural change needed.