Poisoning My Own Codebase: A Reproducible Prompt Injection Test for AI Coding

说明与用途

测试表明，仓库文件中的隐藏指令会导致免费 AI 代码生成模型产生恶意代码。建议的缓解措施包括过滤文件、强化提示、验证输出、沙箱化执行和密钥轮换。

问题

AI coding assistants can be tricked by hidden instructions in repository files, leading to malicious code generation and supply‑chain attacks.

结果

The harness shows that hidden instructions in repo files can override model behavior, producing backdoors, retained debug prints, or malicious dependencies. Free models are especially vulnerable.

工作流

• Create a repo with poisoned files (README, test file, manifest) containing hidden system instructions.
• Run a Python harness that sends tasks (refactor, test, review) to a MonkeyCode free endpoint via OpenAI-compatible API.
• Inspect generated code for backdoors, preserved debug prints, or malicious package recommendations.
• Apply mitigations: filter repo files, harden prompts, validate outputs, sandbox execution, rotate API keys.

证据

If you see these signs, the model followed the contaminated file.

来源

Free models are often optimized for speed and cost. Security training may not be the priority.

来源