Workspace Topology as an Attack Vector in Agentic Coding Assistants

2026-08-14

AI Summary

This study addresses indirect prompt injection risks in intelligent programming assistants by defining the "workspace topology" attack surface and empirically evaluating the security of open-source models and toolchains across ten programming languages and six engineering domains. We systematically analyze how topological dimensions, including directory depth and modularity, influence attack success rates. Results demonstrate that highly modular codebases and secure context frameworks significantly mitigate attack effectiveness, while underscoring the critical role of contamination-free test environments for reliable evaluation. By revealing this novel attack vector, this work provides essential empirical evidence to inform security testing protocols and defensive design strategies for coding agents.

Abstract

Agentic coding assistants are finding widespread use, not just in new code development but in quickly ingesting and leveraging third-party code. This opens up a risk of malicious code being ingested as these coding tools operate with broad filesystem access inside developer workspaces. In this paper, we extensively study the impact of different dimensions of a novel attack surface we term workspace topology -- defined via directory depth, codebase modularity, in-file injection position and context framing -- on the attack success rate of adversarial prompt injection attempts. We perform an empirical study of indirect prompt injection (IPI) across a diverse set of open-source repositories spanning 10 languages and 6 engineering domains, evaluating three IPI entry points against open-weight models operating open source code harnesses. We find that workspace topology measurably affects IPI success. Specifically, changes in codebase modularity can significantly alter the Attack Success Rate (ASR), with highly modular environments demonstrating significantly lower attack success rates. Furthermore, context framing and introduction of security-cues in the workspace can also alter the ASR. Our findings offer practical value for the evaluation and security testing of coding agents across diverse settings, while underscoring the importance of an uncontaminated testing environment to obtain reliable results and conclusions.

Problem

• Agentic coding assistants
• Indirect prompt injection
• Workspace topology
• Attack success rate
• Security

Innovation

• Workspace Topology
• Indirect Prompt Injection
• Agentic Coding Assistants
• Codebase Modularity
• Security Evaluation