NameTrap: bad variable names can steer AI agents toward security flaws
Your AI coding agent reads public repositories, installs third-party packages, and pulls in source files from the web as context. Researchers at Chieh-Yuan Chang’s team just published a paper showing that context can be poisoned without adding a single malicious instruction or vulnerable line of code.
How NameTrap Works
The attack, called NameTrap, works entirely at the identifier level. An attacker takes a clean Python file hosted publicly, renames its variables and functions to align with naming conventions associated with a specific Common Weakness Enumeration entry, and releases that file as bait. No exploit code. No inline instructions. Just different variable names.
An attacker-side coding agent iteratively adjusts those identifiers, then runs local probe completions to confirm the renamed file nudges a target AI agent toward the desired vulnerability. Once it does, the poisoned file goes public.
What the Research Found
The researchers tested NameTrap across six AI coding agents, ten underlying language models, and four vulnerability categories: CWE-78 (OS command injection), CWE-79 (cross-site scripting), CWE-327 (weak cryptography), and CWE-502 (insecure deserialization).
Starting from files whose clean versions never triggered the targeted weakness, identifier-only manipulation achieved overall attack success rates of 22.5% to 56.0% across the six agents. Certain agent and model pairings hit 75.0%. The attack outperformed random renaming, neutral renaming, and a prior identifier-poisoning technique called XOXO.
It also held up under Traditional Chinese prompts and transferred across models that were not part of the original training runs. Adding a security reminder to the system prompt did not consistently prevent the vulnerability from appearing in generated code.
The Detection Gap
Three AI-based security analyzers and four static analysis tools were run against the poisoned files. None of them flagged the targeted weaknesses in the bait files. The files look clean to every scanner because they are clean at the statement level. The damage happens downstream when the agent writes new code influenced by the naming patterns it absorbed.
The Operator Takeaway
If you use Cursor, Copilot, Claude Code, or any agent that pulls in third-party Python files as context, the naming patterns in those files influence what gets written. Dependencies you did not audit, repositories you cloned as reference, Stack Overflow snippets your agent fetched quietly: all of it shapes output.
The paper does not offer a fully reliable defense. Security reminders in the prompt helped inconsistently. The most practical near-term move is treating any web-fetched code as untrusted context, the same way you would treat untrusted user input, and scanning the code your agent produces rather than only the code it consumes.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
