CARI attack injects runtime feedback for coding agents

Researchers introduce Cross-Boundary Adversarial Runtime Injection (CARI), a novel attack setting where peer-controlled software components covertly embed malicious instructions into runtime feedback processed by coding agents. Testing across four programming languages and five models revealed a 94.8% success rate, while also transferring successfully to product-level coding agents like Codex and Claude Code. The findings demonstrate that generic prompt-level defenses are ineffective against CARI without causing excessive suppression of legitimate actions. Open article →