What Your Search Tool Sends Your Coding Agent
Blog post from Upstash
A study of nine verified dangerous documentation pages examined how six retrieval tools and eight language models handle instructions that could lead coding agents to execute unsafe actions, such as downloading unpinned code with root privileges or exposing credentials. Five conventional search tools returned large portions of page content and included harmful passages in 23% to 42% of searches, while Context7, which screens libraries and supplies shorter matched excerpts, did so in 10% of searches; after excluding cases where risky parameters were inherently part of legitimate API answers, Context7 returned none compared with 24% for web search. Most tested pages were not deliberate attacks but good-faith documentation that nevertheless directed users to give durable access to untrusted or unverifiable third parties, highlighting risks beyond prompt injection. When models received web-search results containing dangerous instructions, they repeated them as recommended steps in 35% of applicable answers, usually without warnings, whereas Context7 led to such repetition in under 1% of answers. The authors caution that the small, nonrandom sample cannot measure web-wide prevalence or assess specific coding assistants, but conclude that retrieval-tool design strongly influences what unsafe material reaches an agent.
Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.