Workspace Topology as an Attack Vector in Agentic Coding Assistants

• URL: http://arxiv.org/abs/2608.14876v1
• Date: Fri, 14 Aug 2026 20:30:36 GMT
• Title: Workspace Topology as an Attack Vector in Agentic Coding Assistants
• Abstract summary: Agentic coding assistants are finding widespread use, not just in new code development but in quickly ingesting and leveraging third-party code.<n>This opens up a risk of malicious code being ingested as these coding tools operate with broad access inside developer domains.<n>We study the impact of different dimensions of a novel attack surface on the attack success rate of adversarial prompt injection attempts.
• Score: 33.84924547762174
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Agentic coding assistants are finding widespread use, not just in new code development but in quickly ingesting and leveraging third-party code. This opens up a risk of malicious code being ingested as these coding tools operate with broad filesystem access inside developer workspaces. In this paper, we extensively study the impact of different dimensions of a novel attack surface we term workspace topology -- defined via directory depth, codebase modularity, in-file injection position and context framing -- on the attack success rate of adversarial prompt injection attempts. We perform an empirical study of indirect prompt injection (IPI) across a diverse set of open-source repositories spanning 10 languages and 6 engineering domains, evaluating three IPI entry points against open-weight models operating open source code harnesses. We find that workspace topology measurably affects IPI success. Specifically, changes in codebase modularity can significantly alter the Attack Success Rate (ASR), with highly modular environments demonstrating significantly lower attack success rates. Furthermore, context framing and introduction of security-cues in the workspace can also alter the ASR. Our findings offer practical value for the evaluation and security testing of coding agents across diverse settings, while underscoring the importance of an uncontaminated testing environment to obtain reliable results and conclusions.

Related papers

• Beyond the Payload: How User Invocation Shapes Coding Agent Vulnerability to Repository Poisoning [39.57248170050304]
  Coding agents are increasingly used for software engineering tasks, including bootstrapping projects from third-party repositories.<n>We term these user-side choices Prompt-Level configurations (PLCs) and introduce CIPR (Coding In Poisoned Repos)<n> CIPR comprises 1,920 instances across 20 repositories, four task types, three social-media-grounded prompt styles, and three skill/rule conditions, and measures attack success rate (ASR) and agent alert rate (AR)<n>Vulnerability is highly context-dependent, with task type creating up to a 4.5-fold difference in ASR, with test-
  arXiv  Detail & Related papers  (2026-08-31T12:26:01Z)
• SWE-Touch: Benchmarking Coding Agents When Users Touch the Code [27.67528029348664]
  Real-world software development requires coding agents to operate in shared workspaces where users may inspect and modify code during an ongoing task.<n>We introduce SWE-Touch, a framework that stress-tests this setting through validated Counter-Edits.<n>We evaluate nine coding models on SWE-bench Verified, with additional experiments on longer-horizon tasks from SWE-Bench Pro and DeepSWE.
  arXiv  Detail & Related papers  (2026-08-03T17:03:19Z)
• What Breaks When LLMs Code? Characterizing Operational Safety Failures of Agentic Code Assistants [4.032084095153604]
  We screen 68,816 papers from 22 premier venues, 185 curating safety-relevant studies, and mine 16,586 GitHub issues from widely deployed coding tools.<n>Applying systematic open coding over both corpora, we derive a multi-dimensional safety taxonomy of 33 operational risk types.<n>Our findings show that coding-agent failures are often severe, with 326 of 547 incidents rated high or critical.
  arXiv  Detail & Related papers  (2026-05-29T03:09:37Z)
• AgentHijack: Benchmarking Computer Use Agent Robustness to Common Environment Corruptions [78.49000936275773]
  We introduce AgentHijack, a benchmark designed to evaluate the robustness of computer-use agents under common corruptions.<n>We evaluate a variety of desktop tasks that utilize MLLM-based agents and discover that even minor instances of corruption can result in substantial performance degradation.<n>We propose AgentHijack-Agent, a framework that integrates an action generator with enhanced grounding capabilities and an onlooker responsible for behavior summarization and environment checking.
  arXiv  Detail & Related papers  (2026-05-25T11:09:22Z)
• An Empirical Study of Speculative Decoding on Software Engineering Tasks [10.08815388769347]
  Large Language Models (LLMs) have become widely used for Software Engineering (SE) tasks, spanning from function-level code generation to complex repository-level.<n>However, the high latency of autoregressive inference remains a significant bottleneck, hindering their deployment in interactive environments.<n>We present the first systematic empirical study to evaluate the effectiveness of Speculative Decoding (SD) in SE tasks.
  arXiv  Detail & Related papers  (2026-04-29T09:26:13Z)
• AI-for-Science Low-code Platform with Bayesian Adversarial Multi-Agent Framework [4.782965804438204]
  Large Language Models (LLMs) demonstrate potentials for automating scientific code generation but face challenges in reliability, error propagation, and evaluation.<n>We present a Bayesian adversarial multi-agent framework specifically designed for AI for Science (AI4S) tasks in the form of a Low-code Platform (LCP)<n>Three LLM-based agents are coordinated under the Bayesian framework: a Task Manager that structures user inputs into actionable plans and adaptive test cases, a Code Generator that produces candidate solutions, and an Evaluator providing comprehensive feedback.
  arXiv  Detail & Related papers  (2026-03-03T18:25:00Z)
• RealSec-bench: A Benchmark for Evaluating Secure Code Generation in Real-World Repositories [58.32028251925354]
  Large Language Models (LLMs) have demonstrated remarkable capabilities in code generation, but their proficiency in producing secure code remains a critical, under-explored area.<n>We introduce RealSec-bench, a new benchmark for secure code generation meticulously constructed from real-world, high-risk Java repositories.
  arXiv  Detail & Related papers  (2026-01-30T08:29:01Z)
• Analyzing Code Injection Attacks on LLM-based Multi-Agent Systems in Software Development [11.76638109321532]
  We propose an architecture of a multi-agent system for the implementation phase of the software engineering process.<n>We demonstrate that while such systems can generate code quite accurately, they are vulnerable to attacks, including code injection.
  arXiv  Detail & Related papers  (2025-12-26T01:08:43Z)
• RedCodeAgent: Automatic Red-teaming Agent against Diverse Code Agents [70.24175620901538]
  Code agents have gained widespread adoption due to their strong code generation capabilities and integration with code interpreters.<n>Current static safety benchmarks and red-teaming tools are inadequate for identifying emerging real-world risky scenarios.<n>We propose RedCodeAgent, the first automated red-teaming agent designed to systematically uncover vulnerabilities in diverse code agents.
  arXiv  Detail & Related papers  (2025-10-02T22:59:06Z)
• Ensembling Large Language Models for Code Vulnerability Detection: An Empirical Evaluation [69.8237598448941]
  This study investigates the potential of ensemble learning to enhance the performance of Large Language Models (LLMs) in source code vulnerability detection.<n>We propose Dynamic Gated Stacking (DGS), a Stacking variant tailored for vulnerability detection.
  arXiv  Detail & Related papers  (2025-09-16T03:48:22Z)
• RedCode: Risky Code Execution and Generation Benchmark for Code Agents [50.81206098588923]
  RedCode is a benchmark for risky code execution and generation. RedCode-Exec provides challenging prompts that could lead to risky code execution. RedCode-Gen provides 160 prompts with function signatures and docstrings as input to assess whether code agents will follow instructions.
  arXiv  Detail & Related papers  (2024-11-12T13:30:06Z)
• Compromising Embodied Agents with Contextual Backdoor Attacks [69.71630408822767]
  Large language models (LLMs) have transformed the development of embodied intelligence. This paper uncovers a significant backdoor security threat within this process. By poisoning just a few contextual demonstrations, attackers can covertly compromise the contextual environment of a black-box LLM.
  arXiv  Detail & Related papers  (2024-08-06T01:20:12Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.