MACGEN: Toward Functionally Correct and Secure Code Generation via Multi-Agent Collaboration

Large language models (LLMs) often struggle to balance functional correctness with security, frequently producing code that satisfies requirements but contains vulnerabilities. Existing approaches, such as retrieval-augmented generation or shared-dialogue multi-agent systems, often suffer from either generic advice that is difficult to apply or context bloat and role interference. This paper investigates whether a structured, multi-agent framework using artifact-only interfaces can better enforce role specialization and improve secure code generation.

The authors introduce MACGen, a multi-agent framework inspired by the Secure Software Development Lifecycle (SSDLC). The system decomposes the generation task into four specialized agents:

• Planner: Establishes a high-level functional plan.
• Security Advisor: Identifies potential CWEs, retrieves standards-grounded guidelines from a pre-constructed knowledge base, and synthesizes task-specific constraints.
• Code Generator: Produces code grounded in the functional plan and security guidelines.
• Reviewer: Issues perspective-separated feedback to refine the code.

Crucially, MACGen uses an artifact-only interface where agents exchange structured outputs rather than full dialogue histories. This design prevents role interference and reduces the context degradation often seen in long, shared-dialogue interactions.

MACGen demonstrates consistent improvements across six LLMs and multiple programming languages on the CWEval and BaxBench benchmarks. On CWEval, MACGen improved the joint functionality and security (F&S@1) metric by an average of 19.61 percentage points compared to direct prompting. The framework also maintains a competitive cost profile, consuming significantly fewer tokens than other multi-agent baselines like INDICT. Ablation studies confirm that each agent component contributes to performance, and the artifact-only interface consistently outperforms a shared-context variant.