NameTrap: Steering AI coding agents toward security vulnerabilities through variable names
NameTrap: Steering AI Coding Agents Toward Security Vulnerabilities via Variable Names
Quick read
Based on the paper's full text (AI-generated); refer to the original
The researchers propose NameTrap, a source code poisoning attack that only renames identifiers in third-party Python files without inserting instructions or vulnerable statements, and can induce AI coding agents to generate code containing specified CWE vulnerabilities. The study evaluated six coding agents, ten LLMs, and four CWE categories, with an overall attack success rate of 22.5%–56.0%; individual agent–model combinations reached 75.0%, higher than the 2.1% of random renaming, neutral renaming, and XOXO. The attack remained effective under Traditional Chinese prompts and could transfer across models; security reminders in the prompt failed to reliably prevent it, and the detection rate of the seven AI and static analyzers for the target CWE in poisoned files was 0.
- AI coding agents clone repositories from the Web, install packages, and read source code, and this external code becomes context for the code they generate. The authors propose that an attacker need not inject any instructions; merely the naming of identifiers in third-party Python files may steer the agent toward a specified CWE vulnerability.
- NameTrap has the attacker agent iteratively rename identifiers in an incomplete file according to CWE-specific naming conventions, completing it each round with a local probe and using Bandit/Semgrep scans to confirm whether the target CWE is triggered; the first candidate that succeeds and passes identifier-only validation is published as the bait, and the bait itself contains neither instructions nor vulnerable statements.
- On 6 coding agents, 10 LLMs, and 4 CWE categories, the overall ASR is 22.5%–56.0%, with some agent–model combinations reaching 75.0%, outperforming random renaming, neutral renaming, and XOXO; the attack remains effective under Traditional Chinese prompts, transfers across models, cannot be reliably stopped by safety-reminder defenses, and 7 AI/static analyzers all have a 0 detection rate for the target CWE in the bait.
- The authors point out the need to extend the attack to other programming languages and CWE categories, and to develop identifier-aware defenses that can explicitly reason about the trust assumptions encoded in identifiers; defense directions also include treating third-party code identifiers as untrusted input, performing security analysis on agent-generated changes, and recording the external files they depend on.
The study verified across six coding agents and ten models that merely changing variable names can induce specified CWE vulnerabilities, and none of the seven detection tools raised an alert.