Summary
AI tools that help programmers by automatically choosing and installing software rarely check if the software has trustworthy information to prove it is safe. The authors studied several popular AI models with different software projects and found that these tools almost never looked at security checks before installing packages. Even when software included special safety signals, the AI coding assistants ignored them, suggesting these signals alone do not make an impact. The authors conclude that verifying software safety should be a built-in feature of the programs running AI assistants, not left to the assistants themselves.
AI coding assistantsoftware supply chaintrust signalssoftware bills of materialssigned releasesbuild provenancesoftware verificationopen-source softwareresearch softwaresoftware security
Abstract
AI coding assistants now select, install, and configure software, and attackers have exploited that position through invented package names, compromised maintainer accounts, and manipulated repository text. In response, the supply-chain community publishes machine-checkable trust signals: software bills of materials, signed releases, build provenance attestations, and declared official channels. Whether coding assistants read or act on those signals has not been measured for any of these classes on research software. We pre-registered and ran a controlled study on six open-source research software projects (three HPC, three quantum computing) drawn from an 87-project corpus, with protocol, seed, panel, and analysis plan deposited with a DOI before any trial. W created nine modified copies for each project: no signal, one per signal class, two with a signature or attestation from the wrong issuer, one with all four signals, and one reproducing documented conflicts in the project's own metadata. Three models under two ways of operating an assistant, with and without an approval step, gave 1,920 registered trials, plus a supplement on three frontier models. We scored behavior from container logs rather than from what the assistant said, and recorded the cost of every trial. Verification was rare under every condition: in 9 of 1,920 registered trials (0.5%), the assistant opened any provenance signal before installing in 0 of 384 control trials, and no trial ran a verification command, so signal presence had no measurable effect. We drew three conclusions: publishing signals is necessary but not sufficient; price did not buy verification (the model that verified most often costs $0.10 per trial; the most capable, at $1.00, verified nothing); verification must be built into the program that runs the assistant. We release the per-trial cost ledger, the protocol, and every log.