INFUSE shows prompt-injection success scores diverge from actual repository effects

INFUSE injects adversarial material into the working context of coding agents, including repository files and names, terminal results and archive contents. Because a coding task can involve many steps, the model may react to the material without ever causing the attacker's requested external state. The paper therefore scores the same runs through both a language-model judge and artifact-oriented heuristics, rather than assuming one evaluator is ground truth.

Across 41,824 attack trajectories and 720 benign samples, the reported mean judged success was 19.6%, compared with 15.4% from artifacts, and the two disagreed on 10.8% of individual evaluations. Some judged successes identified apparent adoption of hostile intent without the targeted effect. Conversely, some heuristics flagged actions that were incidental parts of the authorized task. The authors' limited manual adjudication also found judge mistakes. None of these experimental scores should be described as a measured production victim rate.

An investigation needs to preserve the injected surface and the full execution trace, then verify precisely which action changed state and whether the user's permission covered it. A guard can appear effective because its judge rewards refusal language, or appear ineffective because the final file resembles an attack target even though it was produced legitimately. Evidence of a completed unauthorized effect is stronger than either resemblance, while a lack of effect must not be rewritten as successful exploitation.