@inproceedings{v-s-torek-etal-2026-xoxo,
    title = "{XOXO}: Stealthy Cross-Origin Context Poisoning Attacks against {AI} Coding Assistants",
    author = "{\textbackslash}v{\{}S{\}}torek, Adam  and
      Gupta, Mukur  and
      Bhatt, Noopur  and
      Gupta, Aditya  and
      Kim, Janie  and
      Srivastava, Prashast  and
      Jana, Suman",
    editor = "Liakata, Maria  and
      Moreira, Viviane P.  and
      Zhang, Jiajun  and
      Jurgens, David",
    booktitle = "Proceedings of the 64th Annual Meeting of the {A}ssociation for {C}omputational {L}inguistics (Volume 1: Long Papers)",
    month = jul,
    year = "2026",
    address = "San Diego, California, United States",
    publisher = "Association for Computational Linguistics",
    url = "https://preview.aclanthology.org/ingest-acl/2026.acl-long.521/",
    pages = "11350--11373",
    ISBN = "979-8-89176-390-6",
    abstract = "AI coding assistants automatically gather context from potentially untrusted sources to generate code recommendations. We introduce Cross-Origin Context Poisoning (XOXO), a novel attack that exploits this automatic context inclusion by subtly manipulating code without changing its semantics. Attackers introduce semantics-preserving transformations (e.g., renamed variables) to shared code, causing AI assistants to unknowingly recommend vulnerable code patterns to victims. To systematically identify effective transformations, we present Greedy Cayley Graph Search (GCGS), a black-box algorithm that efficiently composes transformations to identify adversarial inputs. Our evaluation demonstrates XOXO{'}s effectiveness at making LLMs generate buggy and vulnerable code, achieving average attack success rates of 73.20{\%} against eight state-of-the-art models including GPT 4.1 and Claude 3.5 Sonnet v2, with vulnerability injection rates up to 66.67{\%}. We also demonstrate a real-world attack against GitHub Copilot, highlighting critical security gaps in current AI coding tools."
}