Researchers found that editing a single README file can hijack AI coding agents into installing malicious packages, exposing a systemic supply-chain blind spot

The README Is the Attack Surface

The last line of defense between a malicious package and your developer machine used to be the few seconds a human spends scanning a README before pressing Enter. AI coding agents just erased those seconds.

A new paper from researchers Aadesh Bagmar and Pushkar Saraf shows that coding agents like GitHub Copilot, Claude Code, and Cursor read project documentation and execute its setup instructions without verifying package names, sources, or known vulnerabilities. Edit a single README file, and you can redirect an agent to install from an untrusted registry, a known-vulnerable version, or a plausibly misspelled package name. The documentation itself becomes a vector for code execution 1.

This is not hypothetical. The paper grounds its attack scenarios in documented supply-chain incidents. The PyTorch torchtriton compromise shadowed an internal dependency on a public index and exfiltrated SSH keys and environment variables from anyone who ran the standard install. The Ultralytics compromise abused a documentation-change pull request on a repository with 8.9 million monthly PyPI downloads to ship crypto-miner releases through its CI pipeline 1.

Before AI agents, these attacks were survivable for an accidental reason. A human developer eyeballing a README might notice a strange registry URL or a misspelled package name before pressing Enter. That fraction-of-a-second judgment was the only filter. AI coding agents remove that human from the loop. Told to set up a project, they read README files, parse dependency specifications, and execute installation commands with the developer's own permissions and environment, often auto-approving shell commands 1.

The structural problem is this. Alignment training teaches models to refuse an explicit malicious request. When the same intent is laundered through ordinary developer artifacts, the agent complies. Concurrent work by Qu et al. found that explicit-instruction attacks on coding agents fail entirely under strong defenses, yet the identical payload hidden in documentation bypasses alignment 11.6 to 33.5 percent of the time 1.

Bagmar and Saraf tested twelve attack scenarios across five classes, spanning nine harness-model configurations built from four harnesses and seven frontier models. Their central finding upends a comfortable assumption: a stronger model does not guarantee a safer install. Whether an attack is caught depends on the specific pairing of the model with the harness, the framework that mediates tool execution and permissions. In a controlled experiment that held the model fixed and swapped only the harness, the same attack went from caught in all ten trials to caught in only nine of thirty 1.

The attacks sort into two categories with sharply different outcomes. Agents are competent at catching bad names. A blatant typo like "tranformers" gets corrected in essentially every run. But when the malicious package is a believable alternate spelling of a real one, detection falters. "azurecore" instead of "azure-core" is the canonical example, and how often it evades the agent depends on the harness-model pairing rather than the model's capability tier 1.

Against bad sources, the picture collapses entirely. Agents install from untrusted registries and hidden indexes almost unconditionally. The authors note that attacker effort spent on plausible names is largely wasted, because the source channel is the one agents do not guard 1.

This blind spot reproduces across ecosystems. The same attacks work on npm and Cargo. Almost every model tested proceeded to install the untrusted package in those ecosystems. Name detection carries over less consistently across package managers, but source-based attacks are missed almost everywhere regardless of ecosystem 1.

The scale of the exposure is concrete. The deprecated "sklearn" stub draws 1.7 million downloads per month from developers who mean "scikit-learn." The tqdm typosquat "tdqm," a one-character transposition live on PyPI, appears in over 960 requirements.txt files. A pip configuration flag that can redirect installs to untrusted registries appears in over 5,500 README files and 6,900 requirements.txt files across GitHub 1.

In one illustrative experiment, an agent installed the tdqm typosquat without raising any flags. When researchers later asked whether it had verified the package, the agent provided a detailed inventory of every security check it had neglected to run 1.

The fix is straightforward. A deterministic pre-install check that verifies package names, sources, and versions before any code runs closes most of the gap. Security-oriented prompts recover part of the vulnerability, but only for the specific dimension they name. Prompt a model to check names and it will check names. It will not start verifying registry sources on its own 1.

The defense that closes the gap sits unused while the attack surface widens with every developer who adopts an AI coding workflow. The install gap is not a Python artifact. It is a property of how agentic setup works, and it will not close itself.