Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This pre-registered study evaluates whether autonomous AI coding assistants verify machine-checkable supply chain trust signals—such as SBOMs, signed releases, and build provenance attestations—before selecting and installing research software dependencies. As coding agents gain execution privileges in development pipelines, their implicit trust in external packages creates severe vulnerabilities to repo manipulation, compromised maintainers, and hallucinated packages. Across 1,920 registered trials and supplementary frontier model evaluations, assistants inspected provenance signals in only 0.5% of runs and executed zero verification commands, with more expensive frontier models showing no improvement over cheaper baselines.
AI coding assistants executed zero verification commands across nearly 2,000 package installations, demonstrating that machine-readable trust signals provide zero supply-chain protection unless actively enforced by the agent harness.
AI coding assistants now select, install, and configure software, and attackers have exploited that position through invented package names, compromised maintainer accounts, and manipulated repository text. In response, the supply-chain community publishes machine-checkable trust signals: software bills of materials, signed releases, build provenance attestations, and declared official channels. Whether coding assistants read or act on those signals has not been measured for any of these classes on research software. We pre-registered and ran a controlled study on six open-source research software projects (three HPC, three quantum computing) drawn from an 87-project corpus, with protocol, seed, panel, and analysis plan deposited with a DOI before any trial. W created nine modified copies for each project: no signal, one per signal class, two with a signature or attestation from the wrong issuer, one with all four signals, and one reproducing documented conflicts in the project's own metadata. Three models under two ways of operating an assistant, with and without an approval step, gave 1,920 registered trials, plus a supplement on three frontier models. We scored behavior from container logs rather than from what the assistant said, and recorded the cost of every trial. Verification was rare under every condition: in 9 of 1,920 registered trials (0.5%), the assistant opened any provenance signal before installing in 0 of 384 control trials, and no trial ran a verification command, so signal presence had no measurable effect. We drew three conclusions: publishing signals is necessary but not sufficient; price did not buy verification (the model that verified most often costs $0.10 per trial; the most capable, at $1.00, verified nothing); verification must be built into the program that runs the assistant. We release the per-trial cost ledger, the protocol, and every log.