Search papers, labs, and topics across Lattice.
This paper systematically evaluates the vulnerability of AI coding agents to supply-chain attacks that exploit project setup documentation, revealing that attackers can manipulate README files and requirements to redirect agents to untrusted or vulnerable packages. The study identifies critical weaknesses in how different harness-model combinations handle these attacks, demonstrating that while agents can detect blatant typosquats, they often fail against more subtle name confusions and source-based threats. A proposed deterministic pre-install check significantly mitigates these risks, underscoring the importance of robust security measures in AI coding environments.
Attackers can weaponize ordinary project documentation to compromise AI coding agents, exposing a critical security gap in how these systems handle package installations.
AI coding agents set up projects by reading documentation and installing the dependencies it lists, without verifying their names, sources, or known vulnerabilities. By editing only a README, requirements file, or Makefile, an attacker can redirect the agent to an untrusted registry, a known-vulnerable version, or a wrong-but-plausible name: documentation becomes a vector for code execution. We present the first systematic evaluation of package-install-time supply-chain attacks delivered through ordinary project-setup documentation across production coding-agent harnesses, probing frontier models on twelve scenarios in five attack classes, grounded in documented incidents. The same model catches an attack through one harness and installs it through another: install-time security rests on the harness-model combination, not the model alone. Agents catch blatant typosquats reliably, but plausible separator-confusion names (azurecore for azure-core) slip through, and how often depends on the harness-model pairing. Source-based attacks like registry redirection are missed almost everywhere. The source blind spot recurs on npm and Cargo, where nearly every model installs the untrusted dependency; name detection carries over less consistently across ecosystems. Security-oriented prompts recover part of the gap but only for the dimension they name; a deterministic pre-install check that verifies names, sources, and versions before any code runs closes most of it.
