In an environment where you can't merge code that fails tests you obviously can't merge new, failing tests.
But how to deal with a newly found bug exploit, meaning you wrote a new test exposing an already existing bug? Test-driven-development would say: Hooray, you have the test, now fix the bug and then commit both.
But what if you a) are a Test engineer who found the exploit but are not able to fix it or b) you would be able to fix it but not right now?
Option One: Commit the test to an extra branch, mention it in the bug issue and essentially leave the code until somebody has mercy and bases their fix upon this branch and commits both.
Option Two: Mark the test somehow as "not nice that it fails but expected", merge it and the Continuous Integration lets it trough. As soon as the bug is fixed, you end the test's special treatment and mark it mandatory. Maybe, the CI would even display the list of expected failures so you have an additional kind of bug tracker.
Are there any common practices / standards out there? Especially for Option Two, do standard test frameworks like JUnit, Google Test,... have any way of modeling it?