Beyond the Payload: How User Invocation Shapes Coding Agent Vulnerability to Repository Poisoning
How the way you ask an AI coder to work shapes whether it gets hacked
The way developers ask AI coding agents to do work—what task, how detailed the instructions, what rules to follow—dramatically changes whether poisoned code repositories can attack those agents. A new benchmark of 1,920 test cases found that certain task types create silent vulnerabilities where malicious code runs undetected, while unclear or rambling prompts can accidentally protect against attacks by making the poison harder to activate.
As companies increasingly hand off coding work to AI agents pulling from repositories they don't fully control, understanding how simple invocation choices affect safety is critical. A developer asking for test execution instead of general setup could expose their system to attack 4.5 times more, and they'd likely never notice. This work gives teams concrete guidance on safer ways to phrase their requests and which tasks pose the highest risk.