Trojan Horse: Automated Repository Poisoning against Coding Agents
The paper introduces TrojanForge, an automated framework for poisoning software repositories against autonomous coding agents by using AST structure, agent execution traces, and a review agent to choose inconspicuous payload locations, then iteratively refining disguises through adversarial interaction with the target agent. What sets it apart is that it moves beyond hand-crafted red-team attacks to scalable, repository-level poisoning with a multilingual benchmark, showing high success rates across many agents, though the abstract mostly reports attack effectiveness and says little about practical defenses or how well the benchmark reflects real-world repository diversity.
Abstract
Coding agents are increasingly capable with autonomy, which exposes them to repository-level poisoning. Existing red-teaming studies remain restricted to manual selection for malicious payload locations and fixed disguise strategies, which cannot represent realistic repository poisoning. We present TrojanForge, the first automated framework for repository poisoning. TrojanForge parses repository structure through abstract syntax trees (AST) and maps agent execution traces onto AST nodes. A security review agent ranks these candidates and selects the least conspicuous ones for payload mounting. Then, through adversarial play with the target agent, TrojanForge iteratively refines disguise strategies by inverting the causes of agent detection, and transfers accumulated success experience across repositories. We further construct TrojanBench, a benchmark of 384 poisoned repositories spanning 6 domains and 9 programming languages. Extensive experiments show that TrojanForge achieves a stable poisoning success rate of over 60% with backdoor injection exceeding 90%. Comprehensive evaluation on TrojanBench across 4 harnesses and 12 models reveals that even commercial agents fail to defend against repository-level poisoning.