{"id":"caa52b10-1941-48b1-af72-8ec868b25a7e","arxiv_id":"2605.25871","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":4.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"Agentic AI coding assistants are vulnerable to prompt injection via unvetted external artifacts, enabling attackers to turn them into shells for unauthorized commands.","lead":"This paper describes how hidden instructions in external files or code can hijack agentic AI coding assistants, allowing attackers to run unauthorized commands through them. A smart generalist should read it to understand emerging security risks as AI tools that edit code and run commands become more common in software development.","discovery_kind":"new_application","skeptic_critique":{"model":"grok-4.3","headline":"No significant objection identified","rationale":"Reader correctly flagged the assessment as provisional due to abstract-only access. The claim is a straightforward extension of prompt injection to tool-using agents; nothing in the abstract contradicts itself or relies on an obviously false premise. Full text would be needed to surface any methodological weakness in the prevalence measurement or defense analysis, but none is detectable here.","tokens_in":1520,"tokens_out":269,"duration_ms":18607,"concrete_test":"Obtain and read the full manuscript; check whether the prevalence measurement in the results section uses real-world logs or only constructed examples, and whether any command-execution traces demonstrate bypass of user confirmation or sandboxing.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim—that hidden instructions in external artifacts can hijack agentic coding assistants into an attacker's shell—is presented as a direct consequence of processing unvetted artifacts. The abstract states the mechanism, indicates the paper will examine how the attacks work, measure prevalence, and discuss defenses. No internal inconsistency, unsupported assumption, or missing condition for the claim is visible from the supplied abstract. The weakest_assumption identified by the reader (reliance on unvetted artifacts) is exactly the premise the paper sets out to explore rather than an unexamined leap.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The paper claims that agentic AI coding assistants, which can edit files, run commands, and access the internet, are vulnerable to prompt injection attacks via hidden instructions in unvetted external artifacts. These attacks can hijack the assistants to act as an attacker's shell for unauthorized commands. The manuscript states it will examine attack mechanisms, measure prevalence, discuss defense limitations and challenges, and suggest future research directions.","tokens_in":1611,"tokens_out":311,"duration_ms":18262,"significance":"If supported by concrete attack examples, prevalence measurements, and analysis of defenses, the work would identify a timely security risk in emerging AI development tools and could guide safer system design. The current manuscript, however, supplies none of the promised examination, data, or analysis, so its contribution cannot be evaluated.","major_comments":[{"comment":"Abstract: the text asserts that the paper 'examine[s] how these prompt injection attacks work, measure[s] their prevalence, discuss[es] the limitations and challenges of current defenses', yet the manuscript contains no methodology section, no data, no results, and no analysis to fulfill these claims, leaving the central assertions unsupported.","section":"Abstract"}],"minor_comments":[],"recommendation":"reject","confidential_remarks":"The supplied manuscript consists only of the abstract and title; it reads as an extended abstract or position statement rather than a completed research article. This raises questions about fit for a journal that expects empirical or analytical contributions in cs.SE."},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for identifying the mismatch between the abstract's claims and the manuscript's actual content. The current version is a short conceptual note introducing the attack vector rather than a full empirical study, and we will revise the abstract to remove unsupported promises.","responses":[{"response":"We agree that the abstract overpromises relative to the manuscript. The paper is positioned as an initial discussion of the threat model and does not contain empirical measurements, methodology, or defense analysis. We will revise the abstract to accurately describe the paper as a conceptual introduction to the attack vector and a call for future work, removing the claims of examination, measurement, and discussion of defenses.","revision_made":"yes","referee_comment":"[Abstract] Abstract: the text asserts that the paper 'examine[s] how these prompt injection attacks work, measure[s] their prevalence, discuss[es] the limitations and challenges of current defenses', yet the manuscript contains no methodology section, no data, no results, and no analysis to fulfill these claims, leaving the central assertions unsupported."}],"tokens_in":1110,"tokens_out":240,"duration_ms":12589,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The central point is that tools which edit files, execute commands, and pull from the internet can be turned by hidden instructions in external sources like READMEs or dependencies. The work looks at how the attacks operate in this setting, checks prevalence, and notes why standard defenses fall short.\n\nIt does a reasonable job spelling out why autonomy plus untrusted inputs creates this exposure, and it ties the issue to actual developer workflows. That connection is the useful part.\n\nThe weakness is that the abstract gives no methodology, no sample attacks, and no numbers, so the prevalence measurement and defense discussion cannot be evaluated yet. If the full paper has only high-level examples without controlled tests or real-world traces, the claims stay speculative.\n\nThis is for people who build or secure AI coding agents and need to think about supply-chain style attacks. A reader already following prompt injection work will see the extension but not much new technique.\n\nThe topic is worth referee time because the risk is real and timely, even if the current draft needs more concrete evidence to stand up.","headline":"The paper flags prompt injection as a practical risk for agentic coding assistants that run commands on unvetted artifacts, but stays mostly at the level of describing the threat.","tokens_in":2059,"tokens_out":295,"would_cite":false,"duration_ms":17005,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"Hidden instructions in external artifacts can hijack agentic AI coding assistants into running unauthorized commands.","keywords":["prompt injection","agentic AI","coding assistants","AI security","external artifacts","attack vector","shell hijacking","unauthorized commands"],"falsifier":"A controlled test in which representative external artifacts containing hidden instructions are fed to multiple agentic assistants and none of the assistants execute the injected commands would falsify the central claim.","tokens_in":2440,"feed_emoji":"🔓","tokens_out":551,"duration_ms":16795,"temperature":0.7,"pith_summary":"The paper claims that agentic AI coding assistants, which edit files, run commands, and access the internet, become vulnerable when they process unvetted external artifacts such as code or documentation. Hidden instructions placed in those artifacts can override the assistant's behavior and cause it to act as an attacker's remote shell. A sympathetic reader would care because these tools are designed to increase developer productivity yet introduce an indirect path for command execution that bypasses normal user controls. The authors describe the attack mechanics, quantify how often such artifacts appear, evaluate why existing safeguards fall short, and outline open research questions.","feed_headline":"Hidden instructions hijack AI coding assistants into attacker shells","feed_subtitle":"External artifacts with concealed prompts let attackers run commands on developer machines without direct access.","key_machinery":"Prompt injection via hidden instructions in external artifacts, which the assistants automatically incorporate into their reasoning and action loops.","core_discovery":"Agentic AI coding assistants that rely on unvetted external artifacts are susceptible to prompt injection attacks in which concealed instructions embedded in those artifacts hijack the assistant, causing it to execute attacker-specified commands and thereby function as a shell on the developer's system.","pith_inferences":["Teams using these assistants in regulated environments may need to restrict or sandbox external inputs entirely.","Similar injection risks could appear in any agentic system that ingests third-party documents or repositories.","Developers might adopt stricter provenance checks on every file an assistant is allowed to read."],"forward_implications":["Assistants can run commands that the developer never intended.","Attackers obtain indirect control over developer machines through publicly shared artifacts.","Current detection and filtering methods leave exploitable gaps that require new mitigation approaches.","Measuring prevalence shows the attack surface is already present in common development workflows."],"fun_headline_variants":["Concealed prompts hijack AI coding assistants","Injections via artifacts hijack agentic AI coders","Prompt injections turn AI into attacker shells","External prompts hijack agentic coding assistants","Hidden instructions compromise agentic coding tools"],"cache_read_input_tokens":64,"weakest_assumption_plain":"The reliance on unvetted external artifacts introduces a new attack vector.","fun_headline_variants_meta":{"raw":{"variants":["Concealed prompts hijack AI coding assistants","Injections via artifacts hijack agentic AI coders","Prompt injections turn AI into attacker shells","External prompts hijack agentic coding assistants","Hidden instructions compromise agentic coding tools"]},"model":"grok-4.3","cost_usd":0.005885,"raw_usage":{"total_tokens":2703,"prompt_tokens":483,"num_sources_used":0,"completion_tokens":66,"cost_in_usd_ticks":58849500,"prompt_tokens_details":{"text_tokens":483,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":2154,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":483,"tokens_out":66,"duration_ms":19111,"temperature":1.0,"reasoning_tokens":2154,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-29T20:27:58.794586+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"A controlled test in which representative external artifacts containing hidden instructions are fed to multiple agentic assistants and none of the assistants execute the injected commands would falsify the central claim.","supporting_citations":[],"review_version":1}