Search papers, labs, and topics across Lattice.
This paper systematically evaluates the security vulnerabilities of AI coding agents, specifically Cursor, Claude Code, and Codex Desktop, against malicious issue requests using a novel benchmark called IssueTrojanBench. The study reveals that 66.5% of these malicious issues successfully bypass existing guardrails, primarily due to weaknesses in the underlying LLMs rather than the agent frameworks themselves. Notably, while GPT models show broad susceptibility, Anthropic's Sonnet 4.6 demonstrates a more selective approach to blocking high-impact actions, underscoring the need for enhanced safety mechanisms in AI coding agents.
Over two-thirds of malicious issue requests can exploit vulnerabilities in leading AI coding agents, highlighting a critical gap in current safety measures.
AI coding agents powered by LLMs are increasingly integrated into real-world software development, where they generate, edit, and execute code with autonomous access to local files and tools. Coding agents inherit security risks from both the LLM backbone, where adversarial prompts, poisoned training data, and backdoor triggers can cause models to emit insecure or attacker-chosen code, and their agentic architecture, where tool-using autonomy enables induced misuse of external APIs, data exfiltration, and persistent compromise of development environments. This paper presents a systematic evaluation of malicious issue requests against state-of-the-art coding agents (Cursor, Claude Code, and Codex Desktop), powered by two major model families (OpenAI GPT-5.3 Codex/GPT-5.4 and Anthropic Sonnet 4.6). Our novel benchmark IssueTrojanBench contains malicious issues that are constructed based on four novel attack categories (i.e., embedded as malicious instructions in issues), six delivery vectors (e.g., PDF, or issue comment), and further augmented by perturbations. Our results reveal critical vulnerabilities in the as-deployed modern coding agents, i.e., 66.5% of the malicious issues from IssueTrojanBench penetrate all the guardrails (agent- and LLM-level) of coding agents. Our further analysis shows that rejection is almost entirely from LLMs rather than the agent frameworks, with GPT models broadly vulnerable and Sonnet 4.6 exhibiting more selective, risk-aware blocking of high-impact actions. Our evaluation also highlights that the current agent-level defense strategy offers limited additional protection for coding agents. Our findings highlight the urgent need for stronger agent- and model-level safety mechanisms to protect AI coding agents.
