Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-07-19 · high
The exploit hides in setup steps, so a review that only checks the code diff would miss it entirely.
Why now: The paper is covered in the July 19, 2026 research briefing on coding-agent risks.
Researchers hijacked a coding agent using nothing but a fake README, per a new arXiv paper (2607.15143). No exploit in the code, no malicious dependency. Just poisoned text in the install steps and bootstrap docs, trusted because the agent needs it to get the project running at all.
That's what makes this attack class hard to catch. The paper's point is that the trust is structural: an agent has to read setup docs to bootstrap itself on unfamiliar code, so it treats them as trusted context by default. It's not a bug you patch with better code review.
Any security process built around auditing code diffs while skimming the README is already checking the wrong file. If you're running agents over repos you don't control, the setup docs need the same scrutiny as the code.
The summary doesn't name which coding agents were tested, or say whether a fix is in the works. That's the open question for anyone deciding how much oversight to put on agent-driven repo setup.
Each link below shares sources, entities, or timing with this story.
Shared entity: README / Same source / Shared topic / Earlier coverage / Tension
Both cover README; cite the same source (arXiv); overlapping topics (against, agent, attack, coding, docs).
Shared entity: README / Same source domain / Shared topic / Earlier coverage / Tension
Both cover README; reported by the same outlet (arxiv.org); overlapping topics (agent, code, coding).
Shared entity: README / Same source domain / Shared topic / Earlier coverage
Both cover README; reported by the same outlet (arxiv.org); overlapping topics (against, code, coding).
Shared entity: README / Shared topic / Earlier coverage
Both cover README; overlapping topics (agent, code, coding, repo); earlier README coverage from 2026-07-10.
Shared entity: README / Same source domain / Shared topic / Earlier coverage
Both cover README; reported by the same outlet (arxiv.org); overlapping topics (agent, code).
Same source domain / Shared topic / Tension
Reported by the same outlet (arxiv.org); overlapping topics (against, agent, code, coding); pushes against this story (against).
Reported by the same outlet (arxiv.org); overlapping topics (against, agent, code, coding); pushes against this story (against).
Reported by the same outlet (arxiv.org); overlapping topics (against, agent, attack, embedded); pushes against this story (against).