Where You Inject Matters asks a narrow but consequential question: does an identical malicious instruction receive the same authority when it appears in a README, a TODO comment, an ordinary code file or retrieved data? In the tested coding-agent setup, repository instruction surfaces were markedly more effective than code and data placements for several…
Inspect the ClaimsCase · DiggingBeagle record
Moving the same prompt injection between README and code changed agent behavior
A study held attacker instructions constant and measured very different success depending on the source surface and position.
Scope
Controlled benchmark placement study, not verified exploitation of the repositories used by ordinary users.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The cited study is a controlled placement comparison, not telemetry from successfully attacked production repositories. Impact remains unrated because the scoped record does not establish a calibrated severity-to-impact-band mapping.
Assessed Oct 31, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-C26-INJECTION-PLACEMENT-EFFECT-1 · Where You Inject Matters: prompt-injection location and success
At a glance
An injection success rate at one placement does not transfer automatically to all file types, agents or task wrappers.
Read the implicationsTransferability to different agent wrappers and repository trust policies is not established. The study does not provide a real compromise denominator.
Limits and uncertaintyFull account
Where You Inject Matters asks a narrow but consequential question: does an identical malicious instruction receive the same authority when it appears in a README, a TODO comment, an ordinary code file or retrieved data? In the tested coding-agent setup, repository instruction surfaces were markedly more effective than code and data placements for several objectives. The paper reports examples where README placement achieved around 86 percent on one reconnaissance objective and 79 percent on a SQL-injection objective, while corresponding code placements were much lower.
The result should not be reduced to an internet-wide attack probability. It depends on the model, task, surface and message rendering. The mechanism is a source-priority problem: task-oriented agents may treat conventional repository guidance as operational instruction even when an attacker can edit that guidance. The same payload can therefore change risk when its location changes, with no new model capability involved.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Timeline
- Oct 30, 2026disclosure
Public disclosure
Claims & evidence
CLM-C26-INJECTION-PLACEMENT-EFFECT-1The paper measured higher prompt-injection success for selected README or TODO placements than for the same payload in code/data in a controlled coding-agent setup.supported
Basis: reported finding
- supportsWhere You Inject Matters: prompt-injection location and successprimary disclosure
arXiv:2610.38867, placement ablation and comparison tables for README/TODO versus code/data
Implications
An injection success rate at one placement does not transfer automatically to all file types, agents or task wrappers.
Controls and mitigations
- Retain source provenance through repository ingestion and test identical payloads across higher- and lower-trust placements.
Unknowns and contradictions
- Transferability to different agent wrappers and repository trust policies is not established.
- The study does not provide a real compromise denominator.
Sources and citation
Material revision history
- Oct 31, 2026 · Canonical change recorded · new in release · revision 208