TrojanForge automates repository poisoning against coding agents
Original title: Trojan Horse: Automated Repository Poisoning against Coding Agents
On 384 poisoned repositories, the authors report over 60% poisoning success and over 90% backdoor injection.
Researchers present TrojanForge, a framework that poisons repositories used by coding agents. It maps execution traces onto abstract syntax trees, ranks inconspicuous sites, and iteratively disguises payloads by inverting detection causes. On TrojanBench, spanning 6 domains and 9 languages, they report stable poisoning success above 60% and backdoor injection above 90%, including failures by commercial agents across 4 harnesses and 12 models.
Unconfirmed: Success rates are the authors' experimental claims and are not independently confirmed.
- A security review agent selects the least conspicuous payload sites.
- Disguise strategies are refined through adversarial play with the target agent.
- Success experience is transferred across repositories.
- TrojanBench contains 384 poisoned repositories.
From the original article
1 min read at arxiv.orgCoding agents are increasingly capable with autonomy, which exposes them to repository-level poisoning. Existing red-teaming studies remain restricted to manual selection for malicious payload locations and fixed disguise strategies, which cannot represent realistic repository poisoning. We present TrojanForge, the first automated framework for repository poisoning.
By Xiao Yang · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.