arXiv cs.AI· Chieh-Yuan Chang, Guan-Wei Chen, Chia-Yi Hsu, Chih Yang, Chia-Mu Yu, Chun-Ying Huang·· 3 小时前精选AI 评分62
NameTrap 论文提出通过变量名诱导 AI 编码智能体引入安全漏洞
NameTrap: Steering AI Coding Agents Toward Security Vulnerabilities via Variable Names
AI 导读
arXiv 论文 NameTrap 提出一种源代码投毒攻击，仅重命名第三方 Python 文件中的标识符，即可诱导 AI 编码智能体写出攻击者指定的 CWE 漏洞，诱饵文件中不含任何指令或漏洞语句。
推荐理由
论文揭示仅靠改写变量名就能诱导 AI 编码智能体引入目标漏洞，对理解不可信网络代码这一新攻击面有参考价值。
正文 · 原文
Abstract:AI coding agents routinely clone repositories, install packages, and read source code obtained from the Web, so publicly hosted code becomes part of the context that shapes the code they write. We show that this Web-borne context can be weaponized without any explicit instruction. We present NameTrap, a source-code poisoning attack that only renames identifiers in third-party Python files to steer AI coding agents toward attacker-targeted Common Weakness Enumeration (CWE) vulnerabilities. An attacker-side coding agent iteratively aligns identifiers with a CWE-specific naming convention and confirms through local probe completions that the renamed file elicits the target weakness, while the released bait contains neither instructions nor vulnerable statements. We evaluate NameTrap across six AI coding agents, ten underlying language models, and four vulnerability categories: CWE-78, CWE-79, CWE-327, and CWE-502. Starting from files whose clean versions never yield the targeted CWE, identifier-level manipulation achieves overall attack success rates of 22.5\% to 56.0\% across the six agents, reaching 75.0\% for certain agent--model configurations, and substantially outperforms random renaming, neutral renaming, and the prior identifier-poisoning attack XOXO. The attack remains effective under Traditional Chinese prompts and transfers across models, while a security-reminder defense fails to consistently prevent vulnerability introduction. Moreover, three AI-based security analyzers and four static analyzers report none of the targeted weaknesses in the poisoned files. These findings expose an overlooked attack surface of agents that consume Web content: seemingly harmless variable names in untrusted, Web-hosted code can compromise the security of downstream software.
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2610.34253 [cs.CR] |
| (or arXiv:2610.34253v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.34253 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Chia-Yi Hsu [view email]
[v1]
Sun, 25 Oct 2026 12:29:23 UTC (1,538 KB)
来源：arXiv cs.AI · arxiv.org