Repo layout changes how easily coding agents get hijacked

A paper posted August 19 tested something nobody's controlled for before: does the shape of a codebase change how easily a coding agent gets hijacked by injected instructions. "Workspace Topology as an Attack Vector in Agentic Coding Assistants" (arXiv 2608.14876) ran open-weight models on open-source harnesses across repos spanning 10 languages and 6 engineering domains, testing three indirect-prompt-injection entry points against directory depth, modularity, injection position, and context framing.

The finding: modularity changes significantly shifted attack success rate, with highly modular environments proving significantly harder to hijack. Security cues placed in the workspace moved it too. The paper reports significance, not an effect size, so there's no clean percentage to quote here.

The mechanism tracks with how these agents actually read code. A 4,000-line monolithic file puts the injected instruction and the legitimate task in one context blob with no structural boundary between them. Break that file into modules and the malicious content lands in one small unit among many, competing with structure for the model's attention. Filesystem boundaries become context-window boundaries.

Two things follow from that. If you've argued for modularity on maintainability grounds and lost, you now have a security argument too, though I'd hold it loosely. One preprint isn't enough to justify a refactor on its own.

The bigger issue is upstream of any single repo. If attack success rate depends on workspace topology, and benchmark authors don't report or control for topology, every published ASR figure from a non-representative test repo is partly measuring directory layout instead of model behavior. That includes numbers repeated in past coverage here. Nobody knows how big that hole is yet. The next agent-security paper worth reading is the one that says what workspace it ran in. Most, so far, don't.