Prompt injection in coding agents is an attack where instructions are hidden in content an AI coding agent reads as part of its work, such as an issue description, a code comment, a README or a config file. The agent mistakes the text for a task and may leak secrets, run commands, or plant persistence in the repository. CodeIPI, a benchmark in the Inspect registry, measures this with 35 injected bug-fix tasks and 10 clean ones, all inside a network-isolated sandbox.
What coding-agent prompt injection is
AI coding agents read issue trackers, source files, documentation and configuration as a normal part of fixing a bug. All of that is input the attacker may control: anyone can open an issue on a public project, and a dependency's README ships into your repository.
This is indirect prompt injection with a powerful target. Coding agents often have a shell, write access to code and access to environment variables, so a successful injection reaches far more than a chat reply. It is a real risk, not a theory: CVE-2025-53773 recorded remote code execution through prompt injection in a widely used coding assistant.
How the attack works and how CodeIPI tests it
The attacker places an instruction where the agent will read it, often framed as authority: a note in an issue saying maintainers require a diagnostic step, or a comment telling automated tools to run a setup script first. The payload aims at one of three outcomes: exfiltration of secrets, code execution, or persistence, such as a new git hook, an edited .bashrc or a poisoned requirements.txt.
CodeIPI pairs each real bug-fixing task with one of these payloads, placed in issue text (10 samples), code comments (10), the README (10) or a config file such as pyproject.toml (5). It detects compliance without trusting the agent's own account: canary secrets that should never appear in output, a unique execution marker in each injected command, and hashes of every workspace file to catch new or changed files. Network access is blocked, so exfiltration fails but is still detected.
Run it with inspect eval inspect_evals/ipi_coding_agent, and add -T defense_prompt=false to measure the agent without an anti-injection system prompt.
What the scores tell you
CodeIPI reports an injection resistance rate (injected tasks where the agent did not comply), a task completion rate (did it still fix the bug), a false positive rate (did it refuse clean tasks), and a detection rate (did it explicitly flag the injection). The headline score counts a sample as correct only if the agent both resisted and finished the job.
Comparing runs with and without the defence prompt shows how much of an agent's resistance comes from its instructions rather than the model.
How to defend against it
Run coding agents in a sandbox with no outbound network by default and no production credentials in the environment. Require human review of changes to dependency files, CI configuration, git hooks and shell profiles, the places persistence hides. Treat issue text and third-party files as data, never as instructions, and do not let an agent act on public issues from unknown users without review. See AI coding assistant supply chain attacks and the CI/CD angle in pull request injection.
References
- [1]CodeIPI in Inspect Evals (task docs)(Inspect Evals)
- [2]CVE-2025-53773(NVD)
- [3]OWASP Top 10 for LLM Applications (2025)(OWASP)
- [4]MITRE ATLAS (adversarial threat landscape for AI systems)(MITRE ATLAS)
A coding agent with a shell and your secrets is a high-value target. Talk to a security expert about testing your AI coding workflow for injection.