New Benchmark Reveals AI Coding Agents Are Vulnerable to Trojan Attacks Hidden in Issue Requests

A new research paper from arXiv reveals critical security gaps in widely-deployed AI coding agents. Researchers constructed and tested a benchmark called IssueTrojanBench to evaluate how well modern coding assistants can resist attacks disguised as legitimate development requests.

The Vulnerability#

The study found that 66.5% of malicious issues successfully bypassed security defenses in tested coding agents—including Cursor, Claude Code, and Codex Desktop. These attacks exploit the fact that AI agents operate with autonomous access to local files, development tools, and APIs, making them potential vectors for code injection, data theft, and environment compromise.

How the Attacks Work#

Researchers designed malicious requests using four novel attack categories delivered through six different channels (such as PDFs or issue comments), with additional variations to test agent robustness. The benchmark simulates real-world scenarios where attackers might craft deceptive issue reports or comments to trick an AI agent into executing harmful code.

Where Defenses Break Down#

Analysis shows that rejection of malicious requests comes almost entirely from the underlying language models rather than the agent frameworks themselves. The findings reveal a stark difference in resilience: OpenAI's GPT models showed broad vulnerability across the board, while Anthropic's Sonnet 4.6 exhibited more selective, risk-aware refusal of high-impact actions. Current agent-level safety strategies offered limited additional protection beyond the model's own guardrails.

Implications#

The research underscores an urgent gap in AI safety as coding agents become more integrated into real-world development workflows. Developers and organizations using these tools may face undetected code injection, exfiltration of sensitive files, or persistent compromise of development environments if malicious actors exploit these weaknesses.