PaperlayerView exact revision on arXiv

Source-linked AI summary

NameTrap: Steering AI Coding Agents Toward Security Vulnerabilities via Variable Names

Chieh-Yuan Chang, Guan-Wei Chen, Chia-Yi Hsu, Chih Yang, Chia-Mu Yu, Chun-Ying Huang

arXiv:2610.34253v1cs.CRcs.AI

TL;DR

Coding agents use Web-hosted code as context, creating a channel through which an attacker may influence generated software. NameTrap exploits that channel by renaming identifiers in third-party Python files, and achieves substantial attack success across agents and CWE targets from screened clean baselines.

  • Problem

    Web-hosted repository and documentation content shapes coding-agent output, raising the question of whether an attacker can use that context to increase a specific weakness.

    Source: §1 · p. 1

  • Method

    NameTrap iteratively applies CWE-conditioned identifier renaming to third-party Python files and probes variants locally, releasing bait without instructions or vulnerable statements.

    Source: §1 · p. 1, §3.3 · p. 3

  • Results

    22.5%–56.0% overall attack success rates across six agents, reaching 75.0% for some agent–model configurations, while outperforming random, neutral, and XOXO.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Untrusted identifier semantics in Web-hosted code are an attack surface for coding agents, and the bait can affect agents beyond the attacker’s queried model.

    Source: §5 · p. 8, §6 · p. 9

    The threat model is limited to Python source: the attacker may only rename identifiers while preserving functionality and lacks knowledge of the victim’s prompt language, model, and agent.

    Source: §3.1 · p. 3

Abstract

from arXiv · show

AI coding agents routinely clone repositories, install packages, and read source code obtained from the Web, so publicly hosted code becomes part of the context that shapes the code they write. We show that this Web-borne context can be weaponized without any explicit instruction. We present NameTrap, a source-code poisoning attack that only renames identifiers in third-party Python files to steer AI coding agents toward attacker-targeted Common Weakness Enumeration (CWE) vulnerabilities. An attacker-side coding agent iteratively aligns identifiers with a CWE-specific naming convention and confirms through local probe completions that the renamed file elicits the target weakness, while the released bait contains neither instructions nor vulnerable statements. We evaluate NameTrap across six AI coding agents, ten underlying language models, and four vulnerability categories: CWE-78, CWE-79, CWE-327, and CWE-502. Starting from files whose clean versions never yield the targeted CWE, identifier-level manipulation achieves overall attack success rates of 22.5\% to 56.0\% across the six agents, reaching 75.0\% for certain agent--model configurations, and substantially outperforms random renaming, neutral renaming, and the prior identifier-poisoning attack XOXO. The attack remains effective under Traditional Chinese prompts and transfers across models, while a security-reminder defense fails to consistently prevent vulnerability introduction. Moreover, three AI-based security analyzers and four static analyzers report none of the targeted weaknesses in the poisoned files. These findings expose an overlooked attack surface of agents that consume Web content: seemingly harmless variable names in untrusted, Web-hosted code can compromise the security of downstream software.

1 Introduction

NameTrap asks whether harmless identifier changes in Web-hosted code can steer coding agents toward specific vulnerabilities, then evaluates an identifier-only attack across agents, models, and CWE categories. Its results show substantial attack success from screened clean baselines and motivate treating untrusted code names as part of agents’ security context.

1 Introduction

  • Web-hosted code shapes agent decisions, so a single public file can influence agents that read it during legitimate development.Agents obtain context by cloning repositories, installing public packages, and retrieving documentation or examples through Web tools.Source: §1 · p. 1
  • Unlike instruction-based attacks, identifier changes can suggest roles and trust assumptions while preserving code execution semantics.Prior work shows identifier semantics affect code models and that semantics-preserving renaming can change model outputs.Source: §1 · p. 1
  • NameTrap uses an attacker-side coding agent to rename identifiers in third-party Python files toward attacker-targeted CWE vulnerabilities.The attacker cannot alter the victim’s task, instructions, model, or agent framework.Source: §1 · p. 1
  • The attacker probes renamed variants locally, but releases bait containing neither instructions nor the vulnerable completion.The weakness appears only when a separate victim agent interprets the poisoned names during a legitimate task.Source: §1 · p. 2
  • 22.5%–56.0% overall ASRs across six agents, reaching 75.0% for some agent–model pairs, while outperforming random, neutral, and XOXO.The evaluation covers four CWE categories and starts from files whose clean versions never yield the target CWE in ten baseline completions.Source: §1 · p. 2

2 Related Work

Related work covers insecure AI-generated code, instruction-based attacks on agents, identifier transformations, and training-time or supply-chain poisoning. NameTrap instead studies whether renamed identifiers in ordinary source files can steer an agent to generate a new, attacker-chosen CWE vulnerability.

Security of AI-generated code

  • NameTrap measures how adversarial context raises the likelihood of a specific CWE relative to screened clean baselines, unlike work measuring insecure-code frequency.Prior research includes insecure AI suggestions and developer outcomes, security benchmarks, repository-level evaluations, and steering with learned prefixes.Source: §2 · p. 2

Prompt injection and context poisoning of LLM agents

  • Prior agent-poisoning work assumes adversarial content contains instructions; NameTrap instead uses valid identifiers that suggest implementation conventions.Instruction hierarchy and structured-query defenses separate trusted instructions from untrusted data, but do not directly target this identifier payload.Source: §2 · p. 2

Identifier semantics and adversarial code transformations

  • Unlike identifier-renaming studies that target prediction errors on fixed tasks, NameTrap targets new code containing an attacker-chosen CWE.Code models use identifier semantics, and semantics-preserving renaming can alter predictions or degrade code-generation robustness.Source: §2 · p. 2

Poisoning code models and the software supply chain

  • NameTrap acts at inference time without training-data or model-parameter access and distributes no malicious code, extending the XOXO poisoning primitive.The paper evaluates CWE-conditioned bait across six agents and ten LLMs, with screened baselines and transfer, defense, and detection analyses.Source: §2 · p. 2

3 Methodology

NameTrap models an attacker who can publish functionality-preserving, identifier-renamed Python code but cannot control the victim agent or its development task. Its construction process uses CWE-conditioned renaming and local completion probes to select identifier-only bait that later induces the targeted weakness when a victim agent completes it.

3.1 Threat Model

  • The attacker may publish identifier-renamed Python files that preserve functionality, but cannot control the victim’s prompt, model, agent, or development environment.The target categories are CWE-78, CWE-79, CWE-327, and CWE-502; success means the victim produces the targeted vulnerability under a benign request.Source: §3.1 · pp. 2–3

3.2 Dataset Collection and Preprocessing

  • 200 source files from 31 GitHub projects were selected, and a file entered the clean baseline only if none of ten completions triggered its target CWE.The files came from the 100 most-starred GitHub projects; retained files also had to be modified by the agent in at least one attempt.Source: §3.2 · p. 3

3.3 Agent-Driven Bait Construction

  • NameTrap treats identifier poisoning as constrained black-box optimization over variants that preserve program behavior, incomplete regions, and all non-identifier content.The ideal objective concerns success across unknown victim agent–prompt configurations, but the study uses bounded local probe feedback rather than estimating that probability directly.Source: §3.3 · p. 3
  • CWE-conditioned naming conventions introduce cues associated with insecure choices while leaving statements, missing-code regions, and other non-identifier content unchanged.The conventions include trusted-command terminology for CWE-78, prevalidated-output terminology for CWE-79, compatibility and fast-digest terminology for CWE-327, and trusted serialized-state terminology for CWE-502.Source: §3.3 · p. 3
  • At most ten passes iteratively rename identifiers; each candidate is completed in a fresh isolated probe, and scanner feedback determines whether to continue.The first locally successful candidate is retained only after identifier-only verification; the released bait is the incomplete renamed file, not the vulnerable completion.Source: §3.3 · pp. 3–4, Figure 1 · p. 4

4 Experimental Evaluation

The evaluation tests CWE-guided identifier renaming against alternative renaming strategies and examines how agent framework and prompt language relate to attack success.

4.1 Experimental Settings

  • Across ten LLMs, the study compares OpenCode, Claude Code, and Codex; gross ASR is computed over all completion attempts, with success requiring a target-CWE scanner report at medium severity or higher.Unless stated otherwise, the six-agent experiments use Qwen-3.5-27B-AWQ-4bit; each victim attempt starts a fresh session.Source: §4.1 · pp. 4–5

4.4 RQ3: Impact of Prompt Language

  • Traditional Chinese prompts raised overall gross ASR for OpenCode (30.8% to 36.9%) and Claude Code (25.0% to 29.0%), but lowered it for Aider (56.0% to 37.0%).The attack remained effective across prompt languages, while the direction of change depended on agent framework.Source: Table 4 · p. 5, §4.4 · p. 6

4.2 RQ1: Impact of Identifier Renaming Strategies

  • Across six agents, overall ASR averaged 31.1% for NameTrap, versus 11.8% for random and 6.6% for neutral renaming.CWE-guided names matched or exceeded both baselines for every agent–CWE pair.Source: §4.2 · p. 5

4.3 RQ2: Impact of Coding Agents

  • The agent-framework comparison held the underlying model constant at Qwen-3.5-27B-AWQ-4bit and covered six agents across four CWE categories.The supplied passages describe this comparison's setup but do not provide its outcome.Source: §4.3 · p. 5

4.5 RQ4: Impact of Underlying Language Models

NameTrap's measured success varies across language models and agent frameworks, and poisoned bait can transfer across models. A security reminder and existing analyzers do not consistently stop or detect the attack.

4.5 RQ4: Impact of Underlying Language Models

  • Across ten LLMs, overall gross ASRs ranged from 5.0% to 75.0% for OpenCode, 12.0% to 33.3% for Claude Code, and 8.8% to 25.0% for Codex.Gemma-4-31B reached 75.0% with OpenCode, 30.0% with Claude Code, and 11.8% with Codex.Source: §4.5 · p. 6

4.6 RQ5: Cross-Model Transferability

  • Transferred CWE-78 bait succeeded in at least one completion for 51.9% of qualifying OpenCode pairs, 73.3% of Claude Code pairs, and 70.0% of Codex pairs.Across 261 qualifying pairs, transferred bait was more effective than on its source model in 68 (26.1%).Source: §4.6 · p. 7

4.7 RQ6: Effectiveness of Prompt-Based Defense

  • Across 30 configurations, the security reminder lowered mean overall gross ASR only from 22.3% to 19.2%, while CWE-502's mean rose from 28.2% to 29.8%.ASR decreased in 13 configurations, increased in 15, and was unchanged in two; the authors note poisoned names present insecure choices as established codebase conventions.Source: §4.7 · p. 7

4.8 RQ7: Detectability of Poisoned Source Code

  • All seven analyzers reported 0.0% detection of targeted CWEs in bait and control code whenever qualifying bait and an applicable rule existed.The blind spot is structural: the bait changes identifiers without adding vulnerable statements, while analyzers assess present code rather than future completions.Source: §4.8 · pp. 7–8, Table 7 · p. 8

4.9 RQ8: Comparison with XOXO

  • NameTrap achieved 23.4%–56.0% overall ASR across six agents, compared with XOXO's 2.1%; XOXO had no success on CWE-78 or CWE-79.On CWE-327, XOXO reached 10.0%, while NameTrap reached 70.0% with Claude Code and 60.0% with OpenCode and Aider.Source: Table 8 · p. 8, §4.9 · p. 8

5 Discussion

Identifier poisoning works because agents infer missing behavior from names and follow trust assumptions encoded in them. The discussion connects this mechanism to Web distribution risks and recommends defenses focused on generated code and provenance.

Why identifier poisoning works

  • Names in incomplete files guide agents’ assumptions about missing behavior, which can lead them to omit sanitization, escaping, or safe APIs.The bait remains valid and functionally identical, so instruction-oriented filters and scanners of present code are not designed to flag it.Source: §5 · p. 8

Why some CWEs are easier to induce

  • CWE-502 and CWE-327 can follow from a single idiomatic library call, while CWE-79 requires omitting escaping despite Web-code defaults.For CWE-78, trusted-command names make shell execution appear consistent with the codebase; CWE-79 also has lower ASR and bait yield.Source: §5 · p. 8

Implications for the Web ecosystem

  • Because bait is functionally identical to its source, misleading names can travel through cosmetic pull requests, forks, mirrors, tutorials, gists, or Q&A examples.Unlike a malicious dependency, the bait passes functional tests and leaves no behavioral trace until an agent extends it.Source: §5 · p. 8

Mitigations

  • Recommended defenses treat third-party identifiers as untrusted, scan every generated change, and record which external files influenced each edit.The targeted weaknesses become detectable once they appear in generated code.Source: §5 · p. 8

Ethical considerations

  • All bait construction and evaluation took place in isolated local environments; no poisoned files were published and no human subjects were involved.The source projects, coding agents, and language models used were publicly available.Source: §5 · p. 8

6 Conclusion

The paper concludes that identifier-only bait can steer coding agents toward attacker-chosen vulnerabilities, despite using no explicit instructions or vulnerable code in the bait. Its findings motivate treating untrusted identifier semantics as part of the attack surface.

6 Conclusion

  • NameTrap steers AI coding agents toward attacker-chosen vulnerabilities solely by renaming identifiers in third-party files.Across six agents, ten LLMs, and four CWE categories, it induces targeted vulnerabilities from screened clean baselines and outperforms random renaming, neutral renaming, and XOXO.Source: §6 · p. 9
  • The attack transfers across models, survives a prompt-level security reminder, and evades seven AI-based and static analyzers.Source: §6 · p. 9
  • The authors identify extending NameTrap to other languages and CWE classes, and developing identifier-aware defenses, as future work.They conclude that untrusted identifier semantics should be treated as part of coding agents’ attack surface when agents use Web-retrieved code.Source: §6 · p. 9

A Additional Results Across Agent–Model Configurations

Traditional Chinese prompts produced higher overall gross ASR in most tested agent–model configurations, with the largest mean increases for CWE-327 and CWE-502.

A Additional Results Across Agent–Model Configurations

B Additional Security Detection Results

Detection tests extended to Claude Code and Codex found no targeted CWEs in poisoned files across either agent’s tested bait/control pairs.

B Additional Security Detection Results

  • No tool detected targeted CWEs in any poisoned file for Claude Code or Codex, across 108 and 121 bait/control pairs, respectively.The tests used the same seven tools and bait/control comparison as the earlier detection experiments.Source: B Additional Security Detection Results · p. 11

C Cross-Model Transferability for Other CWEs

Identifier-poisoned code transfers across LLMs for CWE-79, CWE-327, and CWE-502, sometimes inducing the target weakness more often on another model than on its source model. Transfer varies by CWE and model pair, with some combinations producing no successful attacks and others approaching 100%.

C Cross-Model Transferability for Other CWEs

  • 71.5% of cross-model pairs for CWE-79, 72.4% for CWE-327, and 86.3% for CWE-502 induced the target CWE in at least one completion.For comparison, the corresponding figure for CWE-78 was 65.5%.Source: C Cross-Model Transferability for… · p. 11
  • 58.9% of CWE-79 pairs, 49.8% of CWE-327 pairs, and 47.9% of CWE-502 pairs were more effective than on the source model.Source: C Cross-Model Transferability for… · p. 11
  • Transfer strength depends on the targeted CWE, agent framework, and model pair, ranging from no successful attacks in some combinations to nearly 100% in others.Examples include CWE-79 bait with 10.0% gross ASR on its source model and 100.0% against DeepSeek-V4-Flash-0731, and CWE-502 bait with 17.5% on its source model and 97.5% against that model.Source: C Cross-Model Transferability for… · p. 11

D Prompt-Based Defense Across Coding Agents

The security reminder lowers attack success for some agents and CWE outcomes but raises it for others, so it does not consistently mitigate NameTrap.

D Prompt-Based Defense Across Coding Agents

Loading 2610.34253v1…