analiza aiqbench
This pre-registered audit reveals that current AI coding assistants largely ignore machine-checkable trust signals like provenance attestations and software bills of materials when installing research software. The study demonstrates that neither the presence of these signals nor higher subscription costs incentivize verification, as models rarely execute checks before installation regardless of their pricing tier. Consequently, supply-chain security relies on building verification directly into the execution environment rather than depending on external trust indicators to be read by the assistant.
Do AI Coding Assistants Check Before They Install? A Pre-Registered Demand-Side Audit of Trust Signals in the Research Software Supply Chain
arXiv:2609.07754v1 Announce Type: cross Abstract: AI coding assistants now select, install, and configure software, and attackers have exploited that position through invented package names, compromised maintainer accounts, and manipulated repository text. In response, the supply-chain community publishes machine-checkable trust signals: software bills of materials, signed releases, build provenance attestations, and declared official channels. Whether coding assistants read or act on those signals has not been measured for any of these classes on research software. We pre-registered and ran a controlled study on six open-source research software projects (three HPC, three quantum computing) drawn from an 87-project corpus, with protocol, seed, panel, and analysis plan deposited with a DOI before any trial. W created nine modified copies for each project: no signal, one per signal class, two with a signature or attestation from the wrong issuer, one with all four signals, and one reproducing documented conflicts in the project's own metadata. Three models under two ways of operating an assistant, with and without an approval step, gave 1,920 registered trials, plus a supplement on three frontier models. We scored behavior from container logs rather than from what the assistant said, and recorded the cost of every trial. Verification was rare under every condition: in 9 of 1,920 registered trials (0.5%), the assistant opened any provenance signal before installing in 0 of 384 control trials, and no trial ran a verification command, so signal presence had no measurable effect. We drew three conclusions: publishing signals is necessary but not sufficient; price did not buy verification (the model that verified most often costs $0.10 per trial; the most capable, at $1.00, verified nothing); verification must be built into the program that runs the assistant. We release the per-trial cost ledger, the protocol, and every log.
Abstract:AI coding assistants now select, install, and configure software, and attackers have exploited that position through invented package names, compromised maintainer accounts, and manipulated repository text. In response, the supply-chain community publishes machine-checkable trust signals: software bills of materials, signed releases, build provenance attestations, and declared official channels. Whether coding assistants read or act on those signals has not been measured for any of these classes on research software. We pre-registered and ran a controlled study on six open-source research software projects (three HPC, three quantum computing) drawn from an 87-project corpus, with protocol, seed, panel, and analysis plan deposited with a DOI before any trial. W created nine modified copies for each project: no signal, one per signal class, two with a signature or attestation from the wrong issuer, one with all four signals, and one reproducing documented conflicts in the project's own metadata. Three models under two ways of operating an assistant, with and without an approval step, gave 1,920 registered trials, plus a supplement on three frontier models. We scored behavior from container logs rather than from what the assistant said, and recorded the cost of every trial. Verification was rare under every condition: in 9 of 1,920 registered trials (0.5%), the assistant opened any provenance signal before installing in 0 of 384 control trials, and no trial ran a verification command, so signal presence had no measurable effect. We drew three conclusions: publishing signals is necessary but not sufficient; price did not buy verification (the model that verified most often costs $0.10 per trial; the most capable, at $1.00, verified nothing); verification must be built into the program that runs the assistant. We release the per-trial cost ledger, the protocol, and every log.
18 pages, 11 figures, 8 tables. Pre-registered protocol deposited 2026-08-22 (https://doi.org/10.5281/zenodo.22062503%29%3B tooling v0.2.1 at https://doi.org/10.5281/zenodo.22544144%3B data at https://doi.org/10.5281/zenodo.22546062
Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Software Engineering (cs.SE)
arXiv:2609.07754 [cs.CR]
(or arXiv:2609.07754v1 [cs.CR] for this version)
https://doi.org/10.48550/arXiv.2609.07754 arXiv-issued DOI via DataCite (pending registration)
Text integral sub licența deschisă a publicației · 330 cuvinte
Subiecte conexe
2026.5: We're on the same frequency now 📡
Home Assistant · 6 mai 2026
Links #5: 2026/07
LessWrong · 31 iul. 2026
[AINews] High Taste Testers Ep. 1
Latent Space · 17 oct. 2026
Assistants Rarely Install Software after Checking Trust Signals during Less Than One Percent of Trials
Quantum Zeitgeist · 30 sept. 2026