Runtime feedback injection from peer components compromises coding agents with ~95% success
The claim
CARI attacks can cause coding agents to execute unauthorized actions in the majority of trials
Published as: “CARI: Cross-Boundary Adversarial Runtime Injection in Coding-Agent Workflows”
So what
CARI reveals that LLM-driven coding agents can be hijacked via ordinary runtime feedback, enabling high-impact attacks such as credential exfiltration and massive resource exhaustion across development role boundaries.
The five-minute version
CARI attacks succeed in 94.8% of 3,000 trials, and are dramatically more effective when malicious payloads are delivered as diagnostic feedback (93.3% success) versus static artifacts (8.9%) or runtime logs (35.6%). The attack can amplify token consumption up to 4,755×, and while it transfers to product-level agents, success drops (e.g., to 61.3% on Codex).
What they found 5
- Overall attack success rate is 94.8% across models, languages, and attack instances.
“CARI succeeds in 2,845 of 3,000 trials (94.8%).”
- Delivery context strongly influences success: diagnostic feedback yields ~93% success versus <9% for static artifacts.
“For GPT5.4-mini, aggregate ASR increases from 8.9% under Static Artifact delivery and 35.6% under Runtime Log delivery to 93.3% under the CARI Diagnostic condition.”
- Workflow-level DoS can amplify token usage by over 2,000×, up to 4,755× for some models.
“Successful Workflow-Level DoS executions produce substantial resource amplification. Benign executions consume 3.7K-9.5K tokens (mean 6.0K), whereas successful attacks at N = 100 consume 2.7M-45.0M tokens (mean 12.0M). This corresponds to an aggregate token amplification of 2,004×, with per-model amplification ranging from 491× to 4,755×.”
- Attack effectiveness is consistent across programming languages (94-96% ASR).
“Average ASR is 94.3% for Python, 94.7% for Go, 95.9% for Java, and 94.5% for Rust, a spread of only 1.6 percentage points between the highest and lowest averages.”
- Transfer to product-level agents reduces success but does not eliminate it.
“ASR decreases from 84.7% with mini-swe-agent to 61.3% with Codex for GPT-5.4-mini, and from 98.0% with miniswe-agent to 58.7% with Claude Code for Claude Sonnet 4.5.”
What undercuts it the paper’s own results
- Success drops markedly on product agents, e.g., Modifying File Permissions and Adding a Fake SSH Authorized Key both fall to 0% on Codex and Claude Code.
- Overall ASR on product-level agents is lower (e.g., 61.3% on Codex vs 94.8% overall).
What’s new here 4
- Introduces a direct runtime-injection threat where live component feedback drives coding agents across role boundaries.
- Shows that delivery context (diagnostic feedback) vastly increases attack success compared to static or passive contexts.
- Demonstrates live-source capabilities such as re-delivery, state-conditioned escalation, and downstream re-planting of malicious content.
- Quantifies massive resource amplification (up to 4,755× token increase) via workflow-level denial-of-service.
Artifacts & methods 5
- CARIprimitive
- mini-swe-agentsystem
- Controlled multi-language Todo benchmarkdataset
- GPT-5.4-mini, Claude Sonnet 4.5, Gemini 2.5 Flash, Qwen3-coder, Codestral-2508system
- Codex, Claude Codesystem