Poisoning My Own Codebase: A Reproducible Prompt Injection Test for AI Coding

Описание и применение

Тест демонстрирует, как скрытые инструкции в файлах репозитория могут заставить бесплатные модели генерации кода создавать вредоносный код. Предлагаются меры защиты: фильтрация файлов, усиление запросов, проверка вывода и изоляция выполнения.

Задача

AI coding assistants can be tricked by hidden instructions in repository files, leading to malicious code generation and supply‑chain attacks.

Результат

The harness shows that hidden instructions in repo files can override model behavior, producing backdoors, retained debug prints, or malicious dependencies. Free models are especially vulnerable.

Рабочий процесс

• Create a repo with poisoned files (README, test file, manifest) containing hidden system instructions.
• Run a Python harness that sends tasks (refactor, test, review) to a MonkeyCode free endpoint via OpenAI-compatible API.
• Inspect generated code for backdoors, preserved debug prints, or malicious package recommendations.
• Apply mitigations: filter repo files, harden prompts, validate outputs, sandbox execution, rotate API keys.

Доказательства

If you see these signs, the model followed the contaminated file.

Источник

Free models are often optimized for speed and cost. Security training may not be the priority.

Источник