'Setup Complete, Now You Are Compromised' — New Paper Weaponizes Project Setup Instructions Against AI Coding Agents

arXiv·medium signalXBlueskyLinkedInCopy link

arXiv 2607.15143 (submitted ~July 17-18) demonstrates an attack class where malicious content embedded in a repository's setup instructions — the README, install steps, and bootstrap docs an agent reads before it writes any code — hijacks the coding agent's behavior. This is the natural escalation of the prompt-injection surface for anyone running agents over third-party repos: the agent processes setup docs as trusted context precisely because they're the first thing it must read to be useful.