NameTrap: Steering AI Coding Agents Toward Security Vulnerabilities via Variable Names

Summary

NameTrap is a source-code poisoning attack that renames identifiers in third-party Python files to steer AI coding agents toward attacker-chosen CWE weaknesses (CWE-78, CWE-79, CWE-327, CWE-502) without any explicit instructions or vulnerable statements in the file. Across six agents and ten underlying models, identifier-level manipulation reached attack success rates of 22.5% to 56.0%, with 75.0% for certain agent-model configurations. The attack outperformed random and neutral renaming and XOXO, and three AI-based and four static analyzers failed to flag the targeted weaknesses in the poisoned files.

Topics

• AI agents

Related items

• HighCVE-2026-116843: Mistral Vibe remote code execution via git filter driversSimilar attack · NVD/CVE Database
• MediumMalicious downloads can trick AI coding agents into compromising themselvesSimilar attack · CSO Online
• InfoSteering for Safety, Hijacking for Profit: Trojan Threats in the LLM Activation Steering Supply ChainSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumGHSA-2wqp-q3c6-ccj5: MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpointsSimilar attack · GitHub Advisory Database
• MediumGHSA-vqqp-x5qm-5qp4: FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization serverSimilar attack · GitHub Advisory Database