Beyond the Payload: How User Invocation Shapes Coding Agent Vulnerability to Repository Poisoning
2026-08-31 • Cryptography and Security
Cryptography and SecurityComputation and Language
AI summaryⓘ
The authors study how coding agents, which help with software tasks, can be tricked when using code from possibly unsafe repositories. They focus not just on attacks, but on how users' choices in giving commands (called Prompt-Level Configurations or PLCs) affect the risk. They created a benchmark named CIPR to test these effects across many scenarios and found that the danger depends a lot on the task and how prompts are phrased. For example, some tasks are more vulnerable but less likely to trigger warnings, and vague or noisy prompts can change the attack success and alert rates. This shows that vulnerability depends on how users interact with the coding agents, not just on the code alone.
coding agentsrepository poisoningPrompt-Level Configurationsbenchmarkattack success rateagent alert rateprompt engineeringsoftware securitymalicious code injectiontask delegation
Authors
Fukang Zhu, Binbin Zhao, Ruixiao Lin, Ping He, Tianyu Du, Shouling Ji
Abstract
Coding agents are increasingly used for software engineering tasks, including bootstrapping projects from third-party repositories whose integrity cannot be assumed. Prior work on repository poisoning largely focuses on attacker-controlled injection and disguise, but developers also shape risk through everyday invocation choices: what task to delegate, how to phrase the request, and which skills or rules to supply. We term these user-side choices Prompt-Level Configurations (PLCs) and introduce CIPR (Coding In Poisoned Repos), the first benchmark that systematically varies PLCs in poisoned real-world repositories. CIPR comprises 1,920 instances across 20 repositories, four task types, three social-media-grounded prompt styles, and three skill/rule conditions, and measures attack success rate (ASR) and agent alert rate (AR) using automated runtime and trace-based oracles. Our evaluation reveals two key insights: (1) Vulnerability is highly context-dependent, with task type creating up to a 4.5-fold difference in ASR, with test-execution task forming a silent attack surface (high ASR, low AR). (2) Prompt expression shifts risk indirectly: underspecified prompts reduce ASR by truncating execution depth; noisy prompts exhibit a directional trend toward suppressing alerts by making malicious content less conspicuous. These findings highlight that coding agent vulnerability is not a static property, but a dynamic outcome shaped by everyday user configurations.