Imagine you hire a new junior developer. On their first day, you hand them a README and say "get the project running." They dutifully follow every instruction: install these packages, run this Makefile, pull this dependency. They don't question whether the packages are real, whether the registry is trustworthy, or whether the version has known vulnerabilities — they just follow orders. Now imagine that junior developer is an AI coding agent doing this thousands of times a day, on thousands of projects.

That's the attack surface this paper systematically exposes. The authors show that an attacker doesn't need to touch actual source code to compromise a project handled by an AI coding agent. All they need is to edit a README, requirements.txt, or Makefile — the "setup" instructions the agent reads before writing a single line of code.

The attacks fall into three flavors:

• Registry redirection: Point the agent at an untrusted package index instead of the official one, and it happily installs whatever malicious clone lives there.
• Version pinning attacks: Tell the agent to install a version with a known critical vulnerability. It complies without checking CVE databases.
• Typosquatting via plausibility: Ask for "requsts" instead of "requests" or "python-jwt" instead of "PyJWT." The agent doesn't verify the name is legitimate — it just installs the plausibly-named package, which an attacker has already registered.

The clever insight here is that AI coding agents fundamentally trust documentation as ground truth. Human developers have gut instincts — "wait, why is this pointing to a weird registry?" — built from years of getting burned. Agents have no such intuition. They treat a Markdown instruction with the same authority as a signed release. Documentation, in other words, has become executable code, but nobody is treating it that way from a security standpoint.

The paper's evaluation shows this isn't theoretical: mainstream agents fall for these attacks at high rates, and the payload is trivially small — sometimes a single edited line in a README. Worse, these repositories look completely normal to a human reviewer, because the malicious behavior only manifests when an agent processes the setup instructions.

The authors argue the fix requires agents to treat setup-time instructions as untrusted input: verify package names against known-good registries, check versions against vulnerability databases, and flag redirects to non-standard sources. Essentially, the same skepticism a security-conscious human would apply — but currently absent from the agents shipping to millions of developers.