Attack Context
Security issues affecting repository-aware and tool-using coding agents
16 matching entries
Untrusted issue descriptions and tool responses can redirect privileged coding and tool agents. Twin Agent separates exploration from execution and restricts the information exchanged between them.
Source: arXiv
Shell-command screening can miss harmful actions generated by coding agents. CARE combines static checks with optional model review at the command-dispatch boundary.
Source: arXiv
The paper presents SkillSec-Eval, a controlled evaluation of attacks against reusable agent skills across repository admission, semantic retrieval, planner selection, runtime execution, and updates. It reports that malicious metadata, retrieval manipulation, unsafe workflow composition, and poisoned updates can cause agents to retrieve, select, or execute unintended skills. These are paper-reported benchmark results, not independently verified vulnerabilities in a named production product.
Source: arXiv
Agent data injection (ADI) is a reproducible indirect injection class in which attacker-controlled external content is formatted to resemble trusted metadata or agent-context structure. The paper reports that probabilistic delimiter injection can cause agents to misinterpret untrusted content as trusted element IDs, author identities, or tool responses, leading to unintended clicks, command execution, or PR merges. Safe defensive reproduction should use the authors’ synthetic LLM/AgentDojo…
Source: arXiv
The paper presents a controlled, reproducible evaluation in which untrusted MCP tool descriptions contain hidden instructions that attempt to induce coding agents to access files, invoke other tools, create deceptive links, or execute remote scripts. The authors report that several clients accepted poisoned metadata without adequate validation or parameter visibility; Cursor 1.6.45 was reported unsafe across all four tested vectors. These are paper-reported results from isolated local tests…
Source: arXiv
The paper describes indirect prompt-injection chains in agentic coding assistants where untrusted repository content, skill definitions, extension context, or MCP tool metadata is interpreted as instructions. Its novel skill-chain analysis identifies a concrete authorization weakness: skills can grant broad tool types such as Read or Bash without restricting permitted file targets, allowing repository-supplied instructions to influence sensitive reads or tool execution. The paper is a…
Source: arXiv