Coding agents legitimately parse test logs and runtime diagnostics to decide how to repair code. CARI prepares malicious output that looks like debugging context but contains instructions to modify permissions or run unauthorized steps. Its controlled attack rates vary by agent and setup, and some experiments amplify looping and token use by preventing…
Inspect the ClaimsCase · DiggingBeagle record
CARI turns runtime diagnostics into unauthorized coding-agent actions
Controlled research shows agent execution can be redirected through lower-trust test diagnostics while the original development task continues.
Scope
Attack rates describe fixed controlled harnesses and samples, not real-world incidence; cost amplification is simulated.
Assessment profile
Assessment method- Setting
- simulation
- Exploitation
- demonstrated
- Evidence
- Grade C
- Remediation
- not applicable
- AI role
- AGAINST AI
Basis and provenance
The pinned Claim and its primary disclosure support the described controlled result, but do not establish a population-wide rate or calibrated impact. The source is primary to the described analysis, not independent replication of every outcome. Impact remains unbanded because no calibrated impact rubric for this particular evidence is established.
Assessed Nov 2, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-NOV02-CARI-RUNTIME-FEEDBACK-INJECTION-A · CARI: Cross-Boundary Adversarial Runtime Injection in Coding-Agent Workflows
At a glance
Diagnostic channels can launder commands into decisions; task budgets and host permissions must remain independent of reported errors.
Read the implicationsAttack rates describe fixed controlled harnesses and samples, not real-world incidence; cost amplification is simulated. The evaluation does not identify production victims, real provider charges from the long-loop test, or the rate at which ordinary CI diagnostics contain comparable instructions.
Limits and uncertaintyFull account
Coding agents legitimately parse test logs and runtime diagnostics to decide how to repair code. CARI prepares malicious output that looks like debugging context but contains instructions to modify permissions or run unauthorized steps. Its controlled attack rates vary by agent and setup, and some experiments amplify looping and token use by preventing termination. These are researcher-operated simulations, not evidence of a worm infecting developer machines.
The lower-trust surface is runtime feedback that arrives precisely when a coding agent expects authoritative diagnostic guidance. The paper tests multiple payload intents and reports high success in selected mini-swe-agent configurations; this cannot be extrapolated to all production coding assistants. The separate cost-exhaustion experiment matters because an injected retry instruction can consume the harness budget even when no attacker-requested file change occurs. Both effects require the runner, rather than the model, to enforce per-tool authority and independent step, time and token limits.
Mechanism and trust boundary
- 01
Agent reads test or runtime output
A lower-trust process delivers diagnostic text during a legitimate coding task.
Boundary: Tool stdout and test logs into model context
- 02
Embedded commands appear as remediation advice
The injected text proposes unauthorized filesystem or workflow actions.
Boundary: Diagnostic explanation into decision authority
- 03
Agent follows the injected procedure
Tested configurations execute changes beyond the user request.
Boundary: Model remediation plan into host side effect
Claims & evidence
CLM-2026-NOV02-CARI-RUNTIME-FEEDBACK-INJECTION-ACARI reports 2,845 successful attack trials out of 3,000 in a controlled mini-swe-agent setup that injected malicious runtime feedback, with separate product-agent configurations yielding lower success.supported
Basis: reported finding
- supportsCARI: Cross-Boundary Adversarial Runtime Injection in Coding-Agent Workflowsprimary disclosure
Threat Model, Runtime-Feedback Construction and Evaluation
Implications
Diagnostic channels can launder commands into decisions; task budgets and host permissions must remain independent of reported errors.
Controls and mitigations
- Treat test output as data, gate state-changing tools by task authority and set maximum time, step and token budgets.
- Bind shell and file changes to the original user request; terminate repeated tool-output-driven retries at a harness-enforced budget even if the agent continues requesting them.
Unknowns and contradictions
- Attack rates describe fixed controlled harnesses and samples, not real-world incidence; cost amplification is simulated.
- The evaluation does not identify production victims, real provider charges from the long-loop test, or the rate at which ordinary CI diagnostics contain comparable instructions.
Sources and citation
Material revision history
- Nov 2, 2026 · Canonical change recorded · new in release · revision 214