Fake Job Interviews And AI Agent Poisoning: Securing Untrusted Developer Projects

A project supplied for a job interview can contain executable configuration alongside its source code. In a July 2026 fake-job-interview case, the author found a pre-commit hook inside a ZIP archive’s .git directory. The hook was designed to download and execute an operating-system-specific payload when triggered by Git. An ordinary clone would not copy the sender’s local .git/hooks directory; the archive preserved it.

Microsoft’s research into Contagious Interview documents other execution paths in recruitment assignments, including malicious packages and Visual Studio Code workspace tasks. In the VS Code cases it describes, granting trust to the repository allowed its task configuration to execute and fetch a backdoor.

A project received through LinkedIn or a freelance platform may reach a developer without passing through the company’s email controls. If the engineer uses a work laptop, code they allow to run may inherit access to company repositories and locally available credentials. The organisation needs an approved place to inspect these submissions and a reporting route that accepts suspicious archives without requiring the developer to open them again.

How An External Project Can Poison An Agent

A coding agent can read setup instructions from the same repository it has been asked to inspect. GitHub Copilot, for example, supports repository instructions in .github/copilot-instructions.md. In an external project, the sender controls that file. A malicious instruction could ask the agent to weaken a security check as part of the setup. Whether it succeeds depends on the agent’s handling of untrusted content and the permissions available to its tools.

Code executed during setup can also change what an agent reads in later sessions. In Cisco’s MemoryTrap research, an approved dependency installation modified memory files and global hook configuration outside the downloaded project. Researchers demonstrated that this state could influence subsequent sessions and other projects. OWASP describes this as persistent prompt injection. Claude Code v2.1.50 removed user memories from the system prompt, mitigating the specific high-authority instruction path reported by Cisco.

Isolating The Runtime And Agent State

We recommend an organisation-approved disposable execution environment for unfamiliar projects, with a separate user home and no inherited company credentials. Moving the files into another folder on a work laptop doesn’t restrict the processes that run them. A VM or container needs its own review of host mounts and privileges; sharing the developer’s home directory would expose files that were meant to stay outside the environment.

Run the coding agent inside that environment with a fresh profile, keeping its memory and configuration there too. Recreating the project directory leaves a global agent profile untouched. If the environment mounts persistent agent state from elsewhere, rebuilding it will keep that state available. Potentially affected shared state needs review or replacement before the agent is used with internal repositories again.

Limit outbound connections to what the assignment needs. Access to a package registry still permits dependency code to be downloaded, so network restrictions need to be paired with review of installation commands and approval before execution. Where cloud access is genuinely required, use short-lived, narrowly scoped credentials for a separate test account or project, without importing the developer’s everyday cloud profile.

During initial file inspection, leave VS Code in Restricted Mode. It disables or limits editor features such as workspace tasks. It does not enforce isolation for commands run in a separate shell or other processes outside the editor.

What The Response Team Can Verify

An agent’s logs may omit some of the instructions the model received. A proposed command in a conversation is not proof of execution, and missing records cannot rule out activity. The available evidence depends on what the organisation collects:

• Agent records may show a requested tool call, approval and returned result, depending on the product and its logging configuration.
• Endpoint or runtime telemetry can show a process starting and its parent process, provided monitoring covers the environment where it ran.
• Network records can show observed destinations and connections. DNS lookups alone do not establish that data was transferred.

Preserve the original archive and recruitment or freelance messages alongside those records, without asking the developer to rerun the project. The report should identify which environment opened the project and which credentials were available there, so the response team can assess possible exposure.

Developer Security Exercises With Palisade

Palisade can run a controlled developer-security exercise using a benign project, including an AI agent poisoning scenario. We assess whether the project stays isolated and whether suspicious activity reaches the organisation’s response team with enough evidence to investigate. The exercise uses agreed systems and test data.

This work sits within our Security Consulting and Readiness service. To discuss an exercise for your engineering team, book a free consultation.