Prior work has demonstrated that functionally correct yet vulnerable outputs arise systematically in threat-oriented settings, where adversarial or implicit channels are used to induce security failures in code agents and automated patching workflows. This note introduces a complementary but distinct framing: False Security Confidence (FSC), which studies the same surface phenomenon from a measurement-first perspective in ordinary, non-attack-framed generation tasks. Our interest is not in whether attacks can produce such outputs, but in how frequently and in what forms they appear absent explicit attack pressure, and whether conventional functional evaluation reliably detects them. We formalize FSC rate as the prevalence of security failure within the set of functionally correct outputs, distinguish it from prior joint functional-security metrics such as SAFE and outcome-driven evaluation frameworks such as CWEval, define a three-ecosystem task view for studying how FSC manifests across general-purpose programming, deployment-context tasks, and security-explicit programming, and identify FSC-hard as a practically important refinement layer in which static analyzers miss vulnerabilities that remain dynamically triggerable. This technical report is intentionally scoped as a framework statement rather than a full empirical paper: its purpose is to establish terminology, measurement boundaries, and study design commitments for subsequent large-scale evaluation.

翻译：先前研究已表明，在威胁导向场景中，功能正确但存在漏洞的输出会系统性产生——这些场景利用对抗性或隐式通道诱导代码代理及自动化补丁工作流出现安全故障。本报告提出一种互补但不同的框架：虚假安全信心（False Security Confidence, FSC），它从普通非攻击框架生成任务的测量优先视角出发，研究同一表面现象。我们的关注点并非攻击能否产生此类输出，而是在缺乏明确攻击压力时，这些输出出现的频率与形式，以及常规功能评估能否可靠检测它们。我们将FSC率形式化为功能正确输出集中安全故障的普遍程度，区别于SAFE等先前联合功能安全指标及CWEval等结果驱动评估框架；定义了三生态系统任务视图，用于研究FSC在通用编程、部署上下文任务及安全显式编程中的表现；并将FSC-hard识别为实践中重要的精化层——在此层面，静态分析工具遗漏了可动态触发的漏洞。本技术报告有意限定为框架陈述而非完整实验论文：其目的在于为后续大规模评估确立术语、测量边界及研究设计承诺。