跳转至

文章背景与核心概要

随着AI编程助手越来越多地承担起选择、安装和配置软件的职责，这一角色也经常成为攻击者的靶标——攻击者往往通过打字错误（typosquatting）、被入侵的维护者账户以及被篡改的仓库元数据来进行渗透。为了打击此类攻击，软件供应链安全社区提供了可供机器校验的信任信号，例如软件物料清单（SBOM）、已签名版本、构建溯源证明以及官方安装渠道。

本研究提供了首次受控且经过预注册的需求侧审计，用于评估AI编程助手是否真的会阅读或利用研究软件供应链中的这些信任信号。通过在多个模型、项目（涵盖高性能计算和量子计算）以及操作工作流中进行 1,920 次注册试验，审计结果显示：AI的验证行为几乎完全不存在（整体仅为 0.5%，在控制组和溯源检查中为 0%）。信任信号的存在对助手的行为没有任何可衡量的影响，这证明了仅发布安全信号是必要的，但如果没有直接的架构强制手段，则是根本不够的。

Do AI Coding Assistants Check Before They Install? A Pre-Registered Demand-Side Audit of Trust Signals in the Research Software Supply Chain

arXiv: 2609.07754 [cs.CR]
Submitted: September 7, 2026
Author: Pengyin Shan
Subjects: Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Software Engineering (cs.SE)

arXiv: 2609.07754 [cs.CR]
Submitted: September 7, 2026
Author: Pengyin Shan
Subjects: Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Software Engineering (cs.SE)

执行摘要

AI编程助手越来越负责选择、安装和配置软件——这一角色经常成为攻击者通过排版错误投毒、被盗维护者账号和被篡改的仓库元数据进行攻击的目标。为了应对这一挑战，供应链安全社区提供了可机器检查的信任信号，如软件物料清单 (SBOM)、签名发布、构建溯源证明和官方安装渠道。

本研究进行了首次受控的、预注册的需求侧审计，评估AI编程助手是否真的在研究软件供应链中阅读或响应了这些信任信号。通过对多个模型、项目（涵盖高性能计算和量子计算）以及操作工作流进行 1,920 次注册试验，审计揭示了：AI的验证几乎完全不存在（总体为 0.5%，在对照组和溯源检查中为 0%）。信任信号的存在对助手的行为没有产生任何可测量的影响，这证明发布安全信号是必要的，但如果没有直接的架构强制，则是从根本上不够的。

Executive Summary

AI coding assistants are increasingly responsible for selecting, installing, and configuring software—a role frequently targeted by attackers via typosquatting, compromised maintainer accounts, and manipulated repository metadata. To combat this, the supply-chain security community provides machine-checkable trust signals such as Software Bills of Materials (SBOMs), signed releases, build provenance attestations, and official installation channels.

This study provides the first controlled, pre-registered demand-side audit evaluating whether AI coding assistants actually read or act upon these trust signals within the research software supply chain. Testing 1,920 registered trials across multiple models, projects (covering High-Performance Computing and quantum computing), and operational workflows, the audit revealed that AI verification is virtually non-existent (0.5% overall, and 0% on control and provenance checks). The presence of trust signals had no measurable effect on assistant behavior, proving that publishing security signals is necessary but fundamentally insufficient without direct architectural enforcement.

关键发现与方法论

  • 范围与设计： 评估了从 87 个项目语料库中衍生出的 6 个开源研究软件项目（3个高性能计算，3个量子计算）。每个项目生成了九个修改变体（从无信号到单一信号类别、不正确的签发者签名、所有四个信号以及记录在案的元数据冲突）。
  • 执行： 使用三个AI模型在两种运行模式（有和没有强制审批步骤）下进行了 1,920 次注册试验，并辅以对三个前沿模型的评估。
  • 评估指标： 行为通过容器日志进行客观评分，而不是通过自我报告的模型输出，同时对试验成本进行全面追踪。
  • 结果：
  • 在全部 1,920 次试验中，助手在安装前打开溯源信号的次数仅为 9 次（0.5%）。
  • 在对照组试验中（共 384 次），验证发生的次数为 0次。
  • 没有一次试验成功执行验证命令，导致信任信号完全处于失效状态。
  • 成本不变性： 更高的模型成本并不与更好的安全实践相关。验证最频繁的模型每次试验成本为 0.10 美元，而能力最强的前沿模型（每次试验 1.00 美元）执行了零次验证检查。

Key Findings & Methodology

  • Scope & Design: Evaluated 6 open-source research software projects (3 HPC, 3 quantum computing) derived from an 87-project corpus. Nine modified variations were generated per project (varying from no signals to single signal classes, incorrect issuer signatures, all four signals, and documented metadata conflicts).
  • Execution: Conducted 1,920 registered trials using three AI models under two operating modes (with and without a mandatory approval step), supplemented by evaluations on three frontier models.
  • Evaluation Metric: Behavior was objectively scored via container logs rather than self-reported model outputs, alongside comprehensive tracking of trial costs.
  • Results:
  • Assistants opened provenance signals prior to installation in only 9 out of 1,920 trials (0.5%).
  • In control trials (384 total), verification occurred 0 times.
  • No trial successfully executed a verification command, rendering trust signals entirely inert.
  • Cost Invariance: Higher model cost did not correlate with better security practices. The model that verified most frequently cost \(0.10 per trial, whereas the most capable frontier model (\)1.00 per trial) performed zero verification checks.

结论与建议

  1. 仅靠发布是不够的： 尽管信任信号至关重要，但如果需求侧的消费者（AI助手）忽略它们，仅仅提供它们将无法提供任何被动保护。
  2. 价格买不到安全： 对更大或更昂贵模型的资金投入并不能自然地带来更好的安全审计或供应链警惕性。
  3. 必须实施架构强制： 信任验证不能留给概率性的提示词工程；必须将其直接硬编码到管理AI编程助手的编排层和运行程序中。

Conclusions & Recommendations

  1. Publishing Is Not Enough: While trust signals are crucial, simply making them available provides zero passive protection if demand-side consumers (AI assistants) ignore them.
  2. Price Does Not Buy Safety: Financial investment in larger or more expensive models does not inherently yield better security auditing or supply-chain vigilance.
  3. Architectural Enforcement Required: Trust verification cannot be left to probabilistic prompting; it must be hardcoded directly into the orchestration layers and runner programs that govern AI coding assistants.

数据与人工制品

所有实验协议、种子文件、分析计划和成本账目均已公开： * 预注册协议： Zenodo DOI: 10.5281/zenodo.22062503 * 工具包 (v0.2.1)： Zenodo DOI: 10.5281/zenodo.22544144 * 数据集与日志： Zenodo DOI: 10.5281/zenodo.22546062

Data & Artifacts

All experimental protocols, seed files, analysis plans, and cost ledgers have been openly released: * Pre-registered Protocol: Zenodo DOI: 10.5281/zenodo.22062503 * Tooling (v0.2.1): Zenodo DOI: 10.5281/zenodo.22544144 * Dataset & Logs: Zenodo DOI: 10.5281/zenodo.22546062

全文与访问链接

Full-Text & Access Links