TrojanForge: an automated framework that traps code repositories and deceives developers in over 60 per cent of cases

Researchers have shown that an attacker can automatically hide a malicious payload within a code repository in a location where an AI agent is least likely to detect it. Even commercial agents fall into the trap.

The more independent programming agents gain, the more they execute and modify code they have not written. A team of researchers presents TrojanForge, which it describes as the first automated deposit poisoning tool targeting these agents. Where the previous work by hand chose the location and camouflage of a malicious load, the system analyses the repository structure, observes which parts of the code the affected officer actually consults, and then relies on a security review officer to retain the least visible locations.

The camouflage is then refined by successive tests against the target agent: at each detection, the tool analyses the cause to avoid it the next time, and reuses what it has learned from one deposit to another. The authors also publish TrojanBench, a test bench of 384 trapped deposits covering 6 domains and 9 languages.

Defensive defences

The results are of concern: more than 60% stable success for poisoning and more than 90% for back-door injection. Tested with 4 execution environments and 12 models, including commercial agents, none adequately resists this type of attack, which argues for treating any third party deposit as unreliable when entrusted to an agent.