Aadesh Bagmar

Setup Complete, Now You Are Compromised: Weaponizing Setup Instructions Against AI Coding Agents

Aadesh Bagmar, Pushkar Saraf

AI coding agents set up projects by reading documentation and installing the dependencies it lists, without verifying their names, sources, or known vulnerabilities. By editing only a README, requirements file, or Makefile, an attacker can redirect the agent to an untrusted regis…Read more