Token Smuggling and Log Injection in Open-Source AI Coding Assistants: A Case Study

Our contributions are as follows.
– We build a controlled harness that plants benign canary payloads in build output read by an open-source coding assistant, grades the assistant’s response on a four-state scale, and records every trial for reuse.
– We show that payload encoding drives success independently of wording. Carriage-return injection holds the attack at 80.0% while concealing it from a human reader; zero-width concealment drops it to 13.3% by breaking tokenization, with a non-deterministic residual that rules it out as a defense.
– We show that the assistant’s built-in filter keys on register: an overt directive is refused in every trial (0%), while the same instruction written as a build notice runs in 66.7%, and disabling confirmation lifts that only to 86.7%.
– We test two defenses and find that stripping control characters does nothing to the plain-text attack, while checking the log against the real build output stops it completely.