AI Coding Agents Face Supply Chain Risk as Documentation Portal Shows Vulnerabilities

A new service designed to provide coding agents with up-to-date API documentation may inadvertently introduce a significant software supply chain vulnerability. Context Hub, launched two weeks ago by AI entrepreneur and Stanford adjunct professor Andrew Ng, aims to solve the problem of coding agents using outdated APIs and “hallucinating” parameters. However, security researchers have demonstrated that the platform’s open nature and lack of content sanitization could allow malicious actors to poison AI agents with harmful instructions.

Context Hub: Addressing API Accuracy for AI Agents

Andrew Ng highlighted the issue of API inaccuracies in a LinkedIn post, citing an example where Claude Code incorrectly used an older OpenAI API despite a newer version being available. Context Hub was created to address this, providing a centralized and current source of API documentation for AI coding agents. The project has quickly gained traction, amassing over 6,000 stars on GitHub and scaling to over 1,000 API documents thanks to community contributions and an agentic document writer.

Vulnerability Discovered: Lack of Content Sanitization

Mickey Shmueli, creator of the curated documentation service lap.sh, published a proof-of-concept attack demonstrating the risk. Shmueli’s research reveals that Context Hub delivers documentation through an MCP server, accepting contributions as GitHub pull requests. Critically, the pipeline lacks any content sanitization at any stage. This allows attackers to submit malicious documentation that, once merged, can be accessed by AI agents.

Exploiting the Vulnerability: Poisoning AI Agents

The attack exploits a known weakness in AI models: their inability to reliably distinguish between data and executable instructions. By injecting fake dependencies into documentation, attackers can trick coding agents into incorporating malicious code into configuration files and generated code. Shmueli’s proof-of-concept demonstrates that an attacker can simply create a pull request and if accepted, the “poisoning” is complete. Currently, a significant portion of pull requests are merged – 58 out of 97 closed pull requests were merged as of March 25, 2026.

Model Performance and Broader Implications

Testing with different models from Anthropic revealed varying levels of susceptibility. Haiku consistently incorporated the malicious package, while Sonnet issued warnings in 48% of runs but still included the malicious library 53% of the time. Opus, Anthropic’s most advanced model, performed best, issuing warnings 75% of the time and avoiding the inclusion of the malicious dependency. Shmueli notes that Opus’s superior performance is likely due to its more extensive training and sophistication.

Shmueli’s research likewise indicates that this vulnerability isn’t unique to Context Hub. He found that other systems for providing community-authored documentation to AI models also lack adequate content sanitization. This highlights a broader risk within the emerging landscape of AI-assisted development.

Mitigation and Future Security Considerations

The incident underscores the importance of securing the AI supply chain. As Simon Willison points out in his lethal trifecta AI security model, exposure to untrusted content is a significant risk. To mitigate this, developers should consider restricting AI agents’ network access or, at a minimum, preventing access to private data.