Poisoning My Own Codebase: A Reproducible Prompt Injection Test for AI Coding

Description and use

The test shows how hidden instructions in repo files can trick free AI coding models into generating malicious code. Mitigations include filtering files, prompt hardening, output validation, sandboxing, and key rotation.

Problem

AI coding assistants can be tricked by hidden instructions in repository files, leading to malicious code generation and supply‑chain attacks.

Outcome

The harness shows that hidden instructions in repo files can override model behavior, producing backdoors, retained debug prints, or malicious dependencies. Free models are especially vulnerable.

Workflow

• Create a repo with poisoned files (README, test file, manifest) containing hidden system instructions.
• Run a Python harness that sends tasks (refactor, test, review) to a MonkeyCode free endpoint via OpenAI-compatible API.
• Inspect generated code for backdoors, preserved debug prints, or malicious package recommendations.
• Apply mitigations: filter repo files, harden prompts, validate outputs, sandbox execution, rotate API keys.

Evidence

If you see these signs, the model followed the contaminated file.

Source

Free models are often optimized for speed and cost. Security training may not be the priority.

Source