When running ./gradlew security:security-thymeleaf:nativeTest in the AOT smoke tests, the test fails with:

Failures (3):
  JUnit Jupiter:SecurityThymeleafApplicationTests:loginWithInvalidUserThenUnauthenticated()
    MethodSource [className = 'com.example.security.thymeleaf.SecurityThymeleafApplicationTests', methodName = 'loginWithInvalidUserThenUnauthenticated', methodParameterTypes = '']
    => java.lang.IllegalArgumentException: Could not find field 'tokenRepository' on target object [org.springframework.security.web.csrf.CsrfFilter@6c4f796d] or target class [class org.springframework.security.web.csrf.CsrfFilter]
       org.springframework.test.util.ReflectionTestUtils.getField(ReflectionTestUtils.java:275)
       org.springframework.test.util.ReflectionTestUtils.getField(ReflectionTestUtils.java:217)
       org.springframework.security.test.web.support.WebTestUtils.getCsrfTokenRepository(WebTestUtils.java:111)
       org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors$CsrfRequestPostProcessor.postProcessRequest(SecurityMockMvcRequestPostProcessors.java:517)
       org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestBuilders$FormLoginRequestBuilder.buildRequest(SecurityMockMvcRequestBuilders.java:187)
       org.springframework.test.web.servlet.MockMvc.perform(MockMvc.java:172)
       com.example.security.thymeleaf.SecurityThymeleafApplicationTests.loginWithInvalidUserThenUnauthenticated(SecurityThymeleafApplicationTests.java:36)
       java.base@17.0.5/java.lang.reflect.Method.invoke(Method.java:568)
       org.junit.platform.commons.util.ReflectionUtils.invokeMethod(ReflectionUtils.java:727)
       org.junit.jupiter.engine.execution.MethodInvocation.proceed(MethodInvocation.java:60)
       [...]
  JUnit Jupiter:SecurityThymeleafApplicationTests:loginWithValidUserThenAuthenticated()
    MethodSource [className = 'com.example.security.thymeleaf.SecurityThymeleafApplicationTests', methodName = 'loginWithValidUserThenAuthenticated', methodParameterTypes = '']
    => java.lang.IllegalArgumentException: Could not find field 'tokenRepository' on target object [org.springframework.security.web.csrf.CsrfFilter@6c4f796d] or target class [class org.springframework.security.web.csrf.CsrfFilter]
       org.springframework.test.util.ReflectionTestUtils.getField(ReflectionTestUtils.java:275)
       org.springframework.test.util.ReflectionTestUtils.getField(ReflectionTestUtils.java:217)
       org.springframework.security.test.web.support.WebTestUtils.getCsrfTokenRepository(WebTestUtils.java:111)
       org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors$CsrfRequestPostProcessor.postProcessRequest(SecurityMockMvcRequestPostProcessors.java:517)
       org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestBuilders$FormLoginRequestBuilder.buildRequest(SecurityMockMvcRequestBuilders.java:187)
       org.springframework.test.web.servlet.MockMvc.perform(MockMvc.java:172)
       com.example.security.thymeleaf.SecurityThymeleafApplicationTests.loginWithValidUserThenAuthenticated(SecurityThymeleafApplicationTests.java:29)
       java.base@17.0.5/java.lang.reflect.Method.invoke(Method.java:568)
       org.junit.platform.commons.util.ReflectionUtils.invokeMethod(ReflectionUtils.java:727)
       org.junit.jupiter.engine.execution.MethodInvocation.proceed(MethodInvocation.java:60)
       [...]

This is because the WebTestUtils uses reflection to get and set some fields, therefore, runtime hints need to be added to support test running in native mode.