A README Edit Redirects Your Coding Agent's Installs

Editing a README can redirect a coding agent's installs, an arXiv study finds.

Coding agents install dependencies without checking package names, sources, or CVEs. Anyone who can edit a project's docs can steer what lands on your machine, no code changes required. That's a bigger blast radius than a vulnerable dependency alone, because the attacker doesn't need to touch a single line of code.

The same trick works through a requirements file or a Makefile. Each can push the agent toward an untrusted registry, a vulnerable version, or a wrong-but-plausible package name, per the study. The agent doesn't verify any of it before running the install. It's described as the first systematic look at install-time supply-chain attacks delivered through project docs. The summary doesn't say which coding agent products were tested, or how often each substitution actually worked.

That flips the security assumption most teams still make: reading a repo's code for danger doesn't cover you if the docs are the payload. Once an agent auto-installs from a README, code review that skips the docs isn't reviewing the real attack surface anymore. Most teams still gate pull requests harder than they gate the install script that runs before any of that code executes.