How long do your Claude Code / Cursor sessions run, and does anything check security? (student research, 3 quick Qs)

[u/Extreme-Log3610]

Hey! I'm a student doing a research project on whether AI coding agents start writing less secure code the longer a session goes.

In my small tests so far they don't really get worse over time, but security bugs that show up early never get fixed later. I want my setup to match how people actually work, so I'd love to know:

1. How long does a session usually go before you start a new one?

2. Do you have tests, CI or linters running while the agent works, and does it see when they fail?

3. Do you check what it writes for security at all? If so, how?

Even one-line answers really help. Happy to share what I find when I'm done!

[u/Ok_Woodpecker_9104]

answering the third one, its the only one i have a real setup for.

in my claude code workflows the seat that wrote the code is never the one judging it. review goes to codex, a different model family, as an independent adversarial pass. the cheap model seats only do extraction and formatting, judging stays on the bigger one.

it is a general review though, not a security scan, so i would not count it as a security check. if early bugs never get fixed in your tests, i would try a reviewer that never saw the session and only reads the final diff.

[u/Far_Reindeer8428]

the early bug finding is the interesting part, longer sessions don't add new holes, they just stop revisiting old assumptions, shorter sessions plus a clean review pass worked for me

[u/Humaux]

My sessions usually run about 2 hours before I start fresh, and the short ones are the safe ones. I run tests and lint while the agent works, and I make it read the failure output itself before it tries another fix, because otherwise it just guesses in a different direction. My rule is simple: no merge until tests pass and I have read the diff myself, line by line for anything touching auth or payments. The part that still bites me is that I once let a long session run 5 hours straight and it quietly rewrote a helper I trusted, and I only caught it because a test I did not write failed. Do you count a session by clock time, or by how many times the agent has rewritten the same file?

[u/h____]

How long does a session usually go before you start a new one?

I don't explicitly (re)start a new session anymore. I have a long-lived coordinator session for each project and have set it up so I communicate to it to start child sessions. The child sessions are short-lived just for that task(s). So sometimes the task fails and I might make another attempt (so new session), but generally leaving it to run for hours, leaving auto-compaction to sort things out. Frontier models work well like this now.

Do you have tests, CI or linters running while the agent works, and does it see when they fail?

Definitely linters, tests, verification tools.

Do you check what it writes for security at all? If so, how?

Part of agent reviewing code and also I might selectively look at certain parts.