TrojanForge locates runtime-reachable code paths for repository poisoning of coding agents

The Trojan Horse paper introduces a pipeline for selecting reachable locations in repository code, mounting malicious payloads and measuring whether a coding agent carries those effects through legitimate task work. Its TrojanBench dataset contains 384 poisoned repositories across multiple programming languages and harnesses. The attack succeeds when model behavior or copied code crosses the boundary between untrusted project material and an authorized build, test or execution step.

Reported success rates vary by benchmark setup and whether the measured outcome is placement, execution, or a validated malicious effect. This is not evidence that 384 production repositories were attacked or that all coding agents are equally vulnerable. Repository origin, executable hooks and runtime effects need explicit inspection; a syntactically plausible change can be untrustworthy even when no prompt tells the model to disobey its user.

The attacker works through repository content selected for likely runtime reachability. Successful injection, executed code and verified malicious effect are successive stages and should use separate measurements. A poisoned source file that is never imported has different impact from a changed dependency that a coding agent executes during a legitimate test. The published dataset is an experiment, not a list of affected public repositories.