AI coding assistants are widely used for tasks like code generation. These tools now require large and complex contexts, automatically sourced from various origins$\unicode{x2014}$across files, projects, and contributors$\unicode{x2014}$forming part of the prompt fed to underlying LLMs. This automatic context-gathering introduces new vulnerabilities, allowing attackers to subtly poison input to compromise the assistant's outputs, potentially generating vulnerable code or introducing critical errors. We propose a novel attack, Cross-Origin Context Poisoning (XOXO), that is challenging to detect as it relies on adversarial code modifications that are semantically equivalent. Traditional program analysis techniques struggle to identify these perturbations since the semantics of the code remains correct, making it appear legitimate. This allows attackers to manipulate coding assistants into producing incorrect outputs, while shifting the blame to the victim developer. We introduce a novel, task-agnostic, black-box attack algorithm GCGS that systematically searches the transformation space using a Cayley Graph, achieving a 75.72% attack success rate on average across five tasks and eleven models, including GPT 4.1 and Claude 3.5 Sonnet v2 used by popular AI coding assistants. Furthermore, defenses like adversarial fine-tuning are ineffective against our attack, underscoring the need for new security measures in LLM-powered coding tools.

翻译：AI编码助手广泛应用于代码生成等任务。这些工具如今需要庞大且复杂的上下文，这些上下文自动源自不同源头——跨越文件、项目和贡献者——构成供给底层大语言模型的提示词的一部分。这种自动上下文收集引入了新的漏洞，允许攻击者微妙地投毒输入以破坏助手的输出，可能导致生成脆弱代码或引入关键错误。我们提出一种新型攻击——跨源上下文投毒（XOXO），该攻击由于依赖于语义等价的对抗性代码修改而难以检测。传统程序分析技术难以识别这些扰动，因为代码的语义保持正确，使其看似合法。这使得攻击者能够操纵编码助手产生错误输出，同时将责任转嫁给受害者开发者。我们引入一种新颖的、任务无关的黑盒攻击算法GCGS，该算法利用凯莱图系统性地搜索变换空间，在涵盖五个任务和十一个模型（包括流行AI编码助手使用的GPT 4.1和Claude 3.5 Sonnet v2）的实验中平均达到75.72%的攻击成功率。此外，对抗性微调等防御措施对我们的攻击无效，这凸显了在基于大语言模型的编码工具中亟需新的安全措施。