The report
Coding agents read failing-test output because it often contains exactly the information needed to repair a repository. The CARI study puts malicious directions inside that lower-trust diagnostic stream and asks whether agents turn the apparent repair instruction into an unauthorized action. Its authors report 2,845 successful trials among 3,000 controlled mini-swe-agent evaluations, with different results under product-level agent configurations. Read the study.
The attack does not begin as a direct user request. It begins as output attributed to tools and tests, then crosses into the agent's plan for code and environment changes. The study includes permission changes and workflow-level denial-of-service behavior; under some unbounded tests, malicious retry instructions greatly increase token and step usage. Those are measurements of configured experiments, not bills from known victims. The Case reconstruction separates the malicious feedback entry point from the downstream authority granted by the tool harness.
The useful comparison is not just model refusal
An agent can detect that a test failed yet still give its diagnostic text too much authority. Restricting shell capabilities, write targets and task budgets at the execution layer changes what a successful prompt injection can actually accomplish. Merely hiding suspicious text from a model leaves other diagnostic channels and future test files as potential paths.
To evaluate a defense, replay the same benign repair task with harmless injected diagnostic markers and examine actual filesystem effects, denied operations and resource budgets. A model refusal rate alone is not the outcome; the question is whether the external side effect crossed the protected boundary.