A malicious README can hijack a coding agent

Researchers hijacked a coding agent using nothing but a fake README, per a new arXiv paper (2607.15143). No exploit in the code, no malicious dependency. Just poisoned text in the install steps and bootstrap docs, trusted because the agent needs it to get the project running at all.

That's what makes this attack class hard to catch. The paper's point is that the trust is structural: an agent has to read setup docs to bootstrap itself on unfamiliar code, so it treats them as trusted context by default. It's not a bug you patch with better code review.

Any security process built around auditing code diffs while skimming the README is already checking the wrong file. If you're running agents over repos you don't control, the setup docs need the same scrutiny as the code.

The summary doesn't name which coding agents were tested, or say whether a fix is in the works. That's the open question for anyone deciding how much oversight to put on agent-driven repo setup.