Runtime feedback can stealthily trick coding agents into harmful actions
CARI: Cross-Boundary Adversarial Runtime Injection in Coding-Agent Workflows
Cryptography and SecuritySoftware Engineering
Summary
Coding agents help developers write and test software by interacting with different parts built by various teams. The authors found that one developer’s component can secretly send misleading messages to another coding agent, causing it to make harmful changes without directly hacking it. This trick uses the trust coding agents place in runtime feedback, which normally helps fix problems but here carries hidden instructions. The authors tested many attack methods across popular coding tools and found most attacks succeeded, revealing a new security risk in collaborative software development.
What this means in practice
- •For software security teams: Identify and defend against covert runtime feedback attacks in multi-team software projects to protect development environments and workflows.
- •For devops engineers: Design monitoring and isolation strategies for interdependent development components to prevent runtime feedback from causing unauthorized actions.
Authors
Jie Fu, Shuang Wu, Ashish Kundu, Wendy Hui Wang, Yuan Hong
Abstract
Coding agents increasingly develop, test, and integrate software whose components are owned by different developers, teams, or services. This exposes a distinct attack surface: a malicious or compromised peer development role can manipulate a live component of the software under development (e.g., a backend service, test harness, CI job, or deployment service) and influence the runtime feedback that another role's coding agent must process to complete its task. Although such a component has legitimate diagnostic authority to report its own state, it has no action authority over the victim's local files, credentials, shell, or development environment. We introduce Cross-Boundary Adversarial Runtime Injection (CARI), a direct runtime-feedback injection setting that exploits this authority mismatch. Rather than explicitly compromising the victim's prompt, model, tools, or local environment, the attacker covertly embeds malicious instructions in task-relevant runtime feedback produced by a peer-controlled development component. The victim then interprets that feedback as part of normal debugging or recovery, and may translate the diagnostic guidance into unauthorized victim-side actions. We instantiate ten different attacks based on CARI, spanning resource exhaustion, information exposure, and development-state manipulation. Across four programming languages and five code-capable models, CARI succeeds in 2,845/3,000 (94.8%) trials. Furthermore, CARI transfers effectively to product-level coding agents, achieving 61.3% attack success on Codex and 58.7% on Claude Code. By contrast, prompt-level defenses exhibit a security-utility trade-off: generic warnings are ineffective, whereas explicit policies suppress attacks but substantially over-refuse legitimate actions.