Beyond the Attack Payload: How User Invocation Patterns Affect Coding Agents' Vulnerability to Repository Poisoning

The researchers propose the CIPR benchmark, which systematically varies user prompt-layer configurations across 1,920 instances from 20 real repositories to measure attack success rate and alert rate when coding agents are subjected to repository poisoning. CIPR covers 4 task types, 3 prompt styles derived from social media, and 3 skill or rule conditions, and computes metrics using an automated runtime and a trajectory-based judge. The evaluation shows that exploitability is highly context-dependent, with task type causing up to a 4.5-fold difference in attack success rate, and that test-execution tasks form a silent attack surface with high attack success rate and low alert rate. Under-specified prompts reduce attack success rate by shortening execution depth, while noisy prompts show a trend of lowering the alert rate because they make malicious content less conspicuous.