The adversary can alter only selected benign identifiers in a repository. The coding agent reads those names as task context and later generates new unsafe operations; the attack is evaluated on the produced code, not a preexisting exploit. Across six coding agents under the study’s matched setup, overall attack success ranged from 22.5% to 56.0% for…
Inspect the ClaimsCase · DiggingBeagle record
NameTrap induced vulnerable code from identifier-only source changes
Controlled identifier renaming steered coding agents toward insecure implementations even when the starting code was not vulnerable.
Scope
The measurements are benchmark outcomes with a particular model and task design, not a rate of insecure commits across all software engineering.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
Attacker-controlled source identifiers are changed without inserting an existing vulnerable program. Later agent-generated edits introduce tested CWE weaknesses in controlled coding tasks, with success rates dependent on agent and model. Live malicious pull requests are not established. Impact is left ungraded because a calibrated 0-to-4 impact basis for actual affected targets is unavailable from these Claims.
Assessed Oct 28, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP22-008-A · CLM-CP22-008-B · NameTrap: Steering AI Coding Agents Toward Security Vulnerabilities via Variable Names
At a glance
How easily the identifier bait survives ordinary code review and differs across real repositories remains unmeasured.
Limits and uncertaintyFull account
The adversary can alter only selected benign identifiers in a repository. The coding agent reads those names as task context and later generates new unsafe operations; the attack is evaluated on the produced code, not a preexisting exploit.
Across six coding agents under the study’s matched setup, overall attack success ranged from 22.5% to 56.0% for identifier-based bait in selected CWE categories. The test covers selected command injection, XSS, cryptographic and deserialization weakness classes; malicious semantics were introduced in later agent output. Primary evidence.
The measurements are benchmark outcomes with a particular model and task design, not a rate of insecure commits across all software engineering.
Verify generated security-sensitive actions and data flows independently from the source variables or natural-language identifiers that suggested them.
Claims & evidence
CLM-CP22-008-AAcross six coding agents under the study’s matched setup, overall attack success ranged from 22.5% to 56.0% for identifier-based bait in selected CWE categories.supported
Basis: reported finding
- supportsNameTrap: Steering AI Coding Agents Toward Security Vulnerabilities via Variable Namesprimary disclosure
Section 4, Table 2; six-agent comparison
CLM-CP22-008-BThe test covers selected command injection, XSS, cryptographic and deserialization weakness classes; malicious semantics were introduced in later agent output.supported
Basis: reported finding
- supportsNameTrap: Steering AI Coding Agents Toward Security Vulnerabilities via Variable Namesprimary disclosure
Section 3 threat model; identifier-only verification
Controls and mitigations
- Verify generated security-sensitive actions and data flows independently from the source variables or natural-language identifiers that suggested them.
Unknowns and contradictions
- How easily the identifier bait survives ordinary code review and differs across real repositories remains unmeasured.
Sources and citation
Material revision history
- Oct 28, 2026 · Canonical change recorded · new in release · revision 199