A new study finds that how you organize your code can change whether an AI coding assistant gets tricked into running malicious instructions hidden inside it.
Researchers tested indirect prompt injection - hidden instructions buried in code or files that manipulate an AI agent into acting on them - against open-weight AI coding assistants running open-source code harnesses. They ran the attacks across open-source repositories spanning 10 programming languages and 6 engineering domains, probing three different injection entry points. The variable under study wasn't the attack payload itself but what the researchers call "workspace topology": directory depth, how modular the codebase is, where the injected text sits in a file, and how surrounding context frames it. Highly modular codebases showed significantly lower attack success rates than sprawling ones, and adding explicit security-cue language nearby also suppressed successful attacks.
This matters because most prompt injection research treats an agent's environment as fixed background noise, when this study says it's actually a variable both attackers and defenders can exploit. A well-organized codebase isn't just easier for humans to maintain - it may also be a harder target for an AI agent to be manipulated within. That reframes clean, modular code as a security control, not just a style preference.
The catch: most legacy codebases were never built modular, and refactoring for a threat nobody asked about is a hard sell to any team already behind schedule.