Dormant "explosive prompts" hit 43-83% against nine production coding agents where the direct version hits 3%.

A conditional injection payload stays inert until an attacker-chosen trigger fires, acting as a training-free inference-time backdoor planted in one piece of retrieved content. On frontier models that refuse the bare imperative, the same goal phrased as a dormant conditional drove real state-changing tool execution at 16.5% against 2.4%. Tested on Codex, Gemini CLI, Claude Code CLI, Cursor CLI, Copilot, Devin CLI, Kiro CLI, Qwen Code and Google Assistant at n=30 each. Off-the-shelf injection classifiers were miscalibrated on them. (arXiv 2609.22510)