Elamur Research⌕
☰
home / papers / 2026 / XOXO: Stealthy Cross-Origin Context Poisoning Attacks against AI Coding Assistants

XOXO: Stealthy Cross-Origin Context Poisoning Attacks against AI Coding Assistants

Paper · 2026 · Adam Štorek, Mukur Gupta, Noopur Bhatt et al.

Summary

AI coding assistants quietly pull code from the surrounding project into the LLM prompt. They mix snippets from collaborators and dependencies without marking where each one came from. The authors show that this creates an attack surface, which they name Cross-Origin Context Poisoning (XOXO). A malicious contributor makes meaning-preserving edits to shared code, such as renaming identifiers. When that code later appears in a victim's context, it pushes the model toward buggy or insecure completions.

To find such edits automatically, the authors propose Greedy Cayley Graph Search (GCGS). This black-box procedure combines transformations while greedily lowering the model's confidence. It relies on an observed "confidence monotonicity" effect: stacking several confidence-reducing edits tends to lower confidence even further.

The attack was tested on function-level Python generation with randomly sampled context from the same repository, and on the CWEval-Python secure-coding benchmark. It succeeds against eight frontier LLMs and outperforms unguided search. A working exploit against GitHub Copilot shows the threat is practical. The results point to an architectural weakness in how LLMs treat equivalent code and to the need for provenance-aware defenses.

Key points

  • Attacks were tested on eight state-of-the-art models, including GPT 4.1, Claude 3.5 Sonnet v2 and Qwen 2.5 Coder 32B. The average attack success rate (ASR) was 73.20% overall, 83.67% for bug injection and 52.26% for vulnerability injection.
  • On CWEval-Python, GCGS made models produce code that works but is vulnerable in up to 66.67% of cases. These outputs covered 17 distinct CWE types, typically created by omitting defensive checks such as CRLF or domain validation.
  • The authors surveyed seven major coding assistants. All of them gather context automatically, and none let developers view, limit or log that context.
  • In the Copilot demonstration, renaming a variable from USE_RAW_QUERIES to RAW_QUERIES in a Django project led to an SQL-injection-prone completion. The issue was reported to GitHub and appears to have been remediated.
  • Adversarial fine-tuning did not defend against the attack, with ASR remaining above 87%. Code and data are released at github.com/adamstorek/cross-origin-context-poisoning.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓Stanford UniversityStanford · United States434 works · 314,419 citations🎓Columbia UniversityNew York · United States241 works · 54,053 citations

 Fields, topics and concepts

📚 Shelves 3The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksInformation Systems · 1,437 works

Cite

Cite as Adam Štorek, Mukur Gupta, Noopur Bhatt, Aditya Gupta, Janie Kim, Prashast Srivastava and Suman Jana. 2026. XOXO: Stealthy Cross-Origin Context Poisoning Attacks against AI Coding Assistants. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.acl-long.521

@inproceedings{storek2026xoxo,
  title = {{XOXO: Stealthy Cross-Origin Context Poisoning Attacks against AI Coding Assistants}},
  author = {Adam Štorek, Mukur Gupta, Noopur Bhatt, Aditya Gupta, Janie Kim, Prashast Srivastava and Suman Jana},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.521},
  url = {https://doi.org/10.18653/v1/2026.acl-long.521}
}

References

62 references, 10 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Akamai Security Intelligence Group. 2024. XZ Utils backdoor — everything you need to know, and what you can do. Akamai. Accessed: 2025-09-15. find
  2. Pavol Bielik and Martin Vechev. 2020. Adversarial robustness for code. \#\# Ethical Considerations \#\# Acknowledgments Casey Casalnuovo, Earl T. Barr, Santanu Kumar Dash, Prem Devanbu, and Emily Morgan. 2020. A theory of dual channel constraints. In Proceedings of the ACM/IEEE 42nd International Confer… find
  3. Liguo Chen, Qi Guo, Hongrui Jia, Zhengran Zeng, Xin Wang, Yijiang Xu, Jian Wu, Yidong Wang, Qing Gao, Jindong Wang, Wei Ye, and Shikun Zhang. 2025. A survey on evaluating large language models in code generation tasks. find
  4. Sahana Chennabasappa, Cyrus Nikolaidis, Daniel Song, David Molnar, Stephanie Ding, Shengye Wan, Spencer Whitman, Lauren Deason, Nicholas Doucette, Abraham Montilla, Alekhya Gampa, Beto de Paola, Dominik Gabi, James Crnkovich, Jean-Christophe Testud, Kat He, Rashnil Chaturvedi, Wu Zhou, and Joshua Sa… find
  5. Aldo Cortesi, Maximilian Hils, Thomas Kriechbaumer, and contributors. 2010. mitmproxy: A free and open source interactive HTTPS proxy. [Version 11.0]. find
  6. Jing Cui, Yishi Xu, Zhewei Huang, Shuchang Zhou, Jianbin Jiao, and Junge Zhang. 2024. Recent advances in attack and defense approaches of large language models. arXiv preprint arXiv:2409.03274. — [arXiv:2409.03274](https://arxiv.org/abs/2409.03274) find
  7. Thomas Dohmke. 2024. Bringing developer choice to Copilot with Anthropic’s Claude 3.5 Sonnet, Google’s Gemini 1.5 Pro, and OpenAI’s o1-preview. find
  8. Xiaohu Du, Ming Wen, Zichao Wei, Shangwen Wang, and Hai Jin. 2023. An extensive study on adversarial attack against pre-trained models of code. In Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, ESEC/FSE 2023, page… find
  9. Lindsay Ellis. 2023. ChatGPT can save you hours at work. why are some companies banning it? Wall Street Journal. Accessed: 2025-09-15. find
  10. Zhangyin Feng, Daya Guo, Duyu Tang, Nan Duan, Xiaocheng Feng, Ming Gong, Linjun Shou, Bing Qin, Ting Liu, Daxin Jiang, et al. 2020. CodeBERT: A pre-trained model for programming and natural languages. arXiv preprint arXiv:2002.08155.
  11. Alex Gu, Wen-Ding Li, Naman Jain, Theo Olausson, Celine Lee, Koushik Sen, and Armando Solar-Lezama. 2024. The counterfeit conundrum: Can code language models grasp the nuances of their incorrect generations? In Findings of the Association for Computational Linguistics ACL 2024, pages 74–117, Bangkok… find
  12. Daya Guo, Shuo Ren, Shuai Lu, Zhangyin Feng, Duyu Tang, Shujie Liu, Long Zhou, Nan Duan, Alexey Svyatkovskiy, Shengyu Fu, et al. 2020. Graphcodebert: Pre-training code representations with data flow. arXiv preprint arXiv:2009.08366.
  13. Mukur Gupta, Noopur Bhatt, and Suman Jana. 2025. CodeSCM: Causal analysis for multi-modal code generation. In Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pages 6779– 6… find
  14. Asaf Henig and Cameron Hyde. 2025. Breakdown: Widespread npm supply chain attack puts billions of weekly downloads at risk. Palo Alto Networks Blog. Accessed: 2025-09-15. find
  15. Slobodan Jenko, Niels Mündler, Jingxuan He, Mark Vero, and Martin Vechev. 2025. Black-box adversarial attacks on LLM-based code completion. In Forty-second International Conference on Machine Learning. find
  16. JetBrains. 2025. Artificial Intelligence - The State of Developer Ecosystem in 2025. find
  17. Akshita Jha and Chandan K. Reddy. 2023. Codeattack: code-based adversarial attacks for pre-trained programming language models. In Proceedings of the Thirty-Seventh AAAI Conference on Artificial Intelligence and Thirty-Fifth Conference on Innovative Applications of Artificial Intelligence and Thirte… find
  18. Brittany Johnson, Yoonki Song, Emerson Murphy-Hill, and Robert Bowdidge. 2013. Why don’t software developers use static analysis tools to find bugs? In 2013 35th International Conference on Software Engineering (ICSE), pages 672–681. find
  19. Saurav Kadavath, Tom Conerly, Amanda Askell, Tom Henighan, Dawn Drain, Ethan Perez, Nicholas Schiefer, Zac Hatfield-Dodds, Nova DasSarma, Eli Tran-Johnson, et al. 2022. Language models (mostly) know what they know. arXiv preprint arXiv:2207.05221. find
  20. Hong Jin Kang, Khai Loong Aw, and David Lo. 2022. Detecting false alarms from automatic static analysis tools: how far are we? In Proceedings of the 44th International Conference on Software Engineering, ICSE ’22, page 698–709, New York, NY, USA. Association for Computing Machinery. find
  21. Jordan Henkel, Goutham Ramakrishnan, Zi Wang, Aws Albarghouthi, Somesh Jha, and Thomas Reps. 2022. Semantic robustness of models of source code. In 2022 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER), pages 526–537. find
  22. Woosuk Kwon, Zhuohan Li, Siyuan Zhuang, Ying Sheng, Lianmin Zheng, Cody Hao Yu, Joseph E. Gonzalez, Hao Zhang, and Ion Stoica. 2023. Efficient memory management for large language model serving with pagedattention. In Proceedings of the ACM SIGOPS 29th Symposium on Operating Systems Principles.
  23. Hossein Hosseini, Baicen Xiao, Mayoore S. Jaiswal, and Radha Poovendran. 2017. On the limitation of convolutional neural networks in recognizing negative images. 2017 16th IEEE International Conference on Machine Learning and Applications (ICMLA), pages 352–358. find
  24. Yuhang Lai, Chengxi Li, Yiming Wang, Tianyi Zhang, Ruiqi Zhong, Luke Zettlemoyer, Wen-tau Yih, Daniel Fried, Sida Wang, and Tao Yu. 2023. Ds-1000: a natural and reliable benchmark for data science code generation. In Proceedings of the 40th International Conference on Machine Learning, ICML’23. JMLR… find
  25. Hamel Husain, Ho-Hsiang Wu, Tiferet Gazit, Miltiadis Allamanis, and Marc Brockschmidt. 2019. Codesearchnet challenge: Evaluating the state of semantic code search. arXiv preprint arXiv:1909.09436.
  26. Ziyang Li, Saikat Dutta, and Mayur Naik. 2025. IRIS: LLM-assisted static analysis for detecting security vulnerabilities. In The Thirteenth International Conference on Learning Representations. find
  27. Muhammad Adil Inam, Yinfang Chen, Akul Goyal, Jason Liu, Jaron Mink, Noor Michael, Sneha Gaur, Adam Bates, and Wajih Ul Hassan. 2023. Sok: History is a vast early warning system: Auditing the provenance of system intrusions. In 2023 IEEE Symposium on Security and Privacy (SP). find
  28. D. Liu and S. Zhang. 2024. ALANCA: Active learning guided adversarial attacks for code comprehension on diverse pre-trained and large language models. In 2024 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER), pages 602–613, Rovaniemi, Finland. find
  29. Jiawei Liu, Chunqiu Steven Xia, Yuyao Wang, and Lingming Zhang. 2023. Is your code generated by Chat-GPT really correct? rigorous evaluation of large language models for code generation. In Thirty-seventh Conference on Neural Information Processing Systems. find
  30. Jinjun Peng, Leyi Cui, Kele Huang, Junfeng Yang, and Baishakhi Ray. 2025. CWEval: Outcome-driven evaluation on functionality and security of LLM code generation. In 2025 IEEE/ACM International Workshop on Large Language Models for Code (LLM4Code), pages 33–40. find
  31. Xiaogeng Liu, Peiran Li, G. Edward Suh, Yevgeniy Vorobeychik, Zhuoqing Mao, Somesh Jha, Patrick McDaniel, Huan Sun, Bo Li, and Chaowei Xiao. 2025. AutoDAN-Turbo: A lifelong agent for strategy self-exploration to jailbreak LLMs. In The Thirteenth International Conference on Learning Representations. find
  32. Fábio Perez and Ian Ribeiro. 2022. Ignore previous prompt: Attack techniques for language models. In NeurIPS ML Safety Workshop.
  33. Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. 2024. AutoDAN: Generating stealthy jailbreak prompts on aligned large language models. In The Twelfth International Conference on Learning Representations.
  34. Kellie Roessler. 2025. 2025 ponemon cost of insider risks report: What’s working, what’s not, and what now? https://www.dtexsystems.com/blog/ 2025-cost-insider-risks-takeaways/. Accessed: 2025-09-15. ↗
  35. Haoran Lu, Luyang Fang, Ruidong Zhang, Xinliang Li, Jiazhang Cai, Huimin Cheng, Lin Tang, Ziyu Liu, Zeliang Sun, Tao Wang, Yingchuan Zhang, Arif Hassan Zidan, Jinwen Xu, Jincheng Yu, Meizhi Yu, Hanqi Jiang, Xilin Gong, Weidi Luo, Bolun Sun, Yongkai Chen, Terry Ma, Shushan Wu, Yifan Zhou, Junhao Chen… find
  36. Baptiste Rozière, Jonas Gehring, Fabian Gloeckle, Sten Sootla, Itai Gat, Xiaoqing Ellen Tan, Yossi Adi, Jingyu Liu, Romain Sauvestre, Tal Remez, Jérémy Rapin, Artyom Kozhevnikov, Ivan Evtimov, Joanna Bitton, Manish Bhatt, Cristian Canton Ferrer, Aaron Grattafiori, Wenhan Xiong, Alexandre Défossez, J… — Code Llama: Open Foundation Models for Code
  37. Jinghui Lu, Haiyang Yu, Siliang Xu, Shiwei Ran, Guozhi Tang, Siqi Wang, Bin Shan, Teng Fu, Hao Feng, Jingqun Tang, et al. 2025b. Prolonged reasoning is not all you need: Certainty-based adaptive routing for efficient LLM/MLLM reasoning. arXiv preprint arXiv:2505.15154.
  38. Shuai Lu, Daya Guo, Shuo Ren, Junjie Huang, Alexey Svyatkovskiy, Ambrosio Blanco, Colin Clement, Dawn Drain, Daxin Jiang, Duyu Tang, et al. 2021. CodeXGLUE: A machine learning benchmark dataset for code understanding and generation. arXiv preprint arXiv:2102.04664. find
  39. CheolWon Na, YunSeok Choi, and Jee-Hyong Lee. 2023. DIP: Dead code insertion based black-box attack for programming language model. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 7777–7791, Toronto, Canada. Association for Co… find
  40. Alessandro Parilli and James Maclachlan. 2021. No unaccompanied miners: Supply chain compromises through Node.js packages. Google Cloud Blog. Accessed: 2025-09-15. find
  41. Shuo Ren, Daya Guo, Shuai Lu, Long Zhou, Shujie Liu, Duyu Tang, Neel Sundaresan, Ming Zhou, Ambrosio Blanco, and Shuai Ma. 2020. Codebleu: a method for automatic evaluation of code synthesis. find
  42. Shashank Srikant, Sijia Liu, Tamara Mitrovska, Shiyu Chang, Quanfu Fan, Gaoyuan Zhang, and Una-May O’Reilly. 2021. Generating adversarial computer programs using optimized obfuscations. find
  43. YK Sugi. 2024. Anatomy of a coding assistant. Accessed: 2025-12-31. find
  44. Jeffrey Svajlenko and Chanchal K Roy. 2016. Big-cloneeval: A clone detection tool evaluation framework with bigclonebench. In 2016 IEEE international conference on software maintenance and evolution (ICSME), pages 596–600. IEEE. find
  45. Zhao Tian, Junjie Chen, and Zhi Jin. 2023. Code difference guided adversarial example generation for deep code models. In 2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE), pages 850–862. find
  46. Steven Vaughan-Nichols. 2025. Hacker slips malicious ’wiping’ command into Amazon’s Q AI coding assistant - and devs are worried. ZDNET. find
  47. Shiqi Wang, Zheng Li, Haifeng Qian, Chenghao Yang, Zijian Wang, Mingyue Shang, Varun Kumar, Samson Tan, Baishakhi Ray, Parminder Bhatia, Ramesh Nallapati, Murali Krishna Ramanathan, Dan Roth, and Bing Xiang. 2023a. ReCode: Robustness evaluation of code generation models. In Proceedings of the 61st A… find
  48. Wenhan Wang, Ge Li, Bo Ma, Xin Xia, and Zhi Jin. 2020. Detecting code clones with graph neural network and flow-augmented abstract syntax tree. In 2020 IEEE 27th International Conference on Software Analysis, Evolution and Reengineering (SANER), pages 261–271. IEEE. find
  49. Yue Wang, Hung Le, Akhilesh Gotmare, Nghi Bui, Junnan Li, and Steven Hoi. 2023b. CodeT5+: Open code large language models for code understanding and generation. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 1069–1088, Singapore. Association for Comp… find
  50. Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pier-ric Cistac, Tim Rault, Rémi Louf, Morgan Funtowicz, Joe Davison, Sam Shleifer, Patrick von Platen, Clara Ma, Yacine Jernite, Julien Plu, Canwen Xu, Teven Le Scao, Sylvain Gugger, Mariama Drame, Quentin Lho… — Transformers: State-of-the-Art Natural Language Processing
  51. Fangzhou Wu, Xiaogeng Liu, and Chaowei Xiao. 2023. DeceptPrompt: Exploiting LLM-driven code generation via adversarial natural language instructions. find
  52. Miao Xiong, Zhiyuan Hu, Xinyang Lu, YIFEI LI, Jie Fu, Junxian He, and Bryan Hooi. 2024. Can LLMs express their uncertainty? an empirical evaluation of confidence elicitation in LLMs. In The Twelfth International Conference on Learning Representations. find
  53. Zhou Yang, Jieke Shi, Junda He, and David Lo. 2022. Natural attack for pre-trained models of code. In Proceedings of the 44th International Conference on Software Engineering, ICSE ’22, page 1482–1493, New York, NY, USA. Association for Computing Machinery. find
  54. Noam Yefet, Uri Alon, and Eran Yahav. 2020. Adversarial examples for models of code. Proc. ACM Program. Lang., 4(OOPSLA). find
  55. Zhengran Zeng, Hanzhuo Tan, Haotian Zhang, Jing Li, Yuqun Zhang, and Lingming Zhang. 2022. An extensive study on pre-trained models for program understanding and generation. In Proceedings of the 31st ACM SIGSOFT international symposium on software testing and analysis, pages 39–51. find
  56. Huangzhao Zhang, Zhiyi Fu, Ge Li, Lei Ma, Zhehao Zhao, Hua’an Yang, Yizhe Sun, Yang Liu, and Zhi Jin. 2022. Towards robustness of deep program processing models—detection, estimation, and enhancement. ACM Trans. Softw. Eng. Methodol., 31(3). find
  57. Huangzhao Zhang, Zhuo Li, Ge Li, Lei Ma, Yang Liu, and Zhi Jin. 2020. Generating adversarial examples for holding robustness of source code processing models. Proceedings of the AAAI Conference on Artificial Intelligence, 34(01):1169–1176. find
  58. Jie Zhang, Wei Ma, Qiang Hu, Shangqing Liu, Xiaofei Xie, Yves Le Traon, and Yang Liu. 2023. A black-box attack on code models via representation nearest neighbor search. In Findings of the Association for Computational Linguistics: EMNLP 2023, pages 9706–9716, Singapore. Association for Computationa… find
  59. Shuyin Zhao. 2023. GitHub Copilot now has a better AI model and new capabilities. The GitHub Blog. Accessed: 2024-11-11. find
  60. Shasha Zhou, Mingyu Huang, Yanan Sun, and Ke Li. 2024. Evolutionary multi-objective optimization for contextual adversarial example generation. Proc. ACM Softw. Eng., 1(FSE). find
  61. Yaqin Zhou, Shangqing Liu, Jingkai Siow, Xiaoning Du, and Yang Liu. 2019. Devign: Effective vulnerability identification by learning comprehensive program semantics via graph neural networks. Advances in neural information processing systems, 32. find
  62. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models.

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/storek-2026-xoxo-stealthy-cross-origin-context/