# Does Runtime Topology Context Improve LLM-Generated Kubernetes Security Patches?

Source: [arXiv](https://arxiv.org/abs/2607.25995v1)  
Feed7 permalink: https://feed7.dev/p/2607-25995v1-1ifq7b4  
Published: 2026-07-28T17:12:12.000Z  
Trust: Needs Review (needs_review)

## Why Included

Kubernetes security patches improved sharply when the model received live service dependencies, showing that scanner findings alone omit context needed to avoid breaking workloads.

## Source Summary

KuTIE combines Istio call edges, Trivy findings, and service-account bindings before asking an LLM to patch Kubernetes configurations. Evaluation covered **248 trials** on a 36-deployment cluster with 31 findings across seven dependency classes.

## Practical Implication

Feed remediation agents the runtime relationships their patches must preserve. For topology-dependent findings, correctness rose from **11.1% with scanner-only context** to **78.0% with topology context**.

## Agent-Ready Context

KuTIE combines Istio call edges, Trivy findings, and service-account bindings before asking an LLM to patch Kubernetes configurations. Evaluation covered **248 trials** on a 36-deployment cluster with 31 findings across seven dependency classes.

Feed remediation agents the runtime relationships their patches must preserve. For topology-dependent findings, correctness rose from **11.1% with scanner-only context** to **78.0% with topology context**.

The topology-independent control showed **no improvement**, supporting a context-specific effect rather than generic prompt enrichment. The study used one purpose-built healthcare cluster, and one of seven dependency classes did not show the broader pattern.

## Connected Context

Feed7 judgment across 262 accumulated Signals:

KuTIE provides controlled evidence that context engineering should be dependency-aware, not merely additive: runtime topology sharply improved patches only when findings depended on that topology, while unrelated cases did not benefit. This strengthens the case for agents retrieving bounded, task-relevant relationships and for evaluating context effects per case, while limiting generalization to the tested cluster and dependency classes.

- [The Illusion of Robustness: Aggregate Accuracy Hides Prediction Flips under Task-Irrelevant Context](https://feed7.dev/p/2607-12963v1-1oc0qmr) — KuTIE supplies the positive counterpart to context-induced prediction flips: relevant topology helps dependent cases, reinforcing the need to measure context effects per task rather than through aggregate accuracy.
- [AI tools for Forward Deployed Engineering — Vasuman Moza, Varick Agents](https://feed7.dev/p/ai-tools-for-forward-deployed-engineering-vasuman-moza-varick-agents-12kjg79) — The measured benefit of preserving real runtime relationships supports Varick’s broader prescription to capture how work actually operates before automating risky steps.
- [RLM: Recursive Language Models for Large Codebases - Shashi, Superagentic AI](https://feed7.dev/p/rlm-recursive-language-models-for-large-codebases-shashi-superagentic-ai-1w21nex) — KuTIE demonstrates why bounded evidence retrieval should select dependency relationships required by the patch instead of adding undifferentiated context.
- [The AI bugpocalypse is here. Now what? - Jack Cable, Corridor](https://feed7.dev/p/the-ai-bugpocalypse-is-here-now-what-jack-cable-corridor-1y20rna) — It gives a concrete implementation consequence for placing security review inside agent workflows: remediation agents need runtime dependencies, scanner findings, and identity bindings to avoid breaking relationships their patches must preserve.

## Context Map

- Layer: context
- Domains: security, coding
- Topics: context-engineering, agent-reliability

## Uncertainty

- The topology-independent control showed **no improvement**, supporting a context-specific effect rather than generic prompt enrichment. The study used one purpose-built healthcare cluster, and one of seven dependency classes did not show the broader pattern.

## Agent Instruction

Use this item as source-backed context. Do not invent claims beyond the linked source. If this item conflicts with another source, call out the conflict.