Recoleta
GitHub
Source note

How Agentic AI Coding Assistants Become the Attacker's Shell

Authors
Yue Liu, Yanjie Zhao, Yunbo Lyu, Ting Zhang, Haoyu Wang, David Lo
Source
arXiv
Published
Collection
Software Intelligence
AI Coding AssistantsPrompt InjectionSoftware Supply Chain SecurityAgentic SystemsCode Intelligence
Open arXivMarkdown source

Summary

The paper argues that agentic AI coding assistants can turn hidden instructions in files, skills, repositories, and live services into terminal commands with the developer's privileges. Its evidence comes from AIShellJack tests plus recent CVEs across Cursor, GitHub Copilot, Claude Code, Zed.dev, Codex, and Windsurf.

Problem

  • AI coding assistants read developer prompts and untrusted project context in the same input stream, so attacker text inside a file can be treated as an instruction.
  • The risk matters because these assistants can edit files, run shell commands, install packages, and access the network on a developer machine.
  • A successful injection can steal SSH keys or AWS credentials, change authentication files, create user accounts, or install cron jobs for persistence.

Approach

  • The authors use AIShellJack, an automated test suite with 314 attack payloads covering 70 MITRE ATT&CK techniques.
  • They test Cursor v1.2.2 and GitHub Copilot v1.102 on 5 real codebases written in TypeScript, Python, C++, and JavaScript.
  • Each run adds a poisoned coding rule file, gives the assistant a normal coding task, and records the commands the assistant executes.
  • The paper also maps injection sources across repository files, shared agent skills, MCP servers, IDE settings, websites, APIs, and messaging tools.

Results

  • Across 314 payloads, attack success rates ranged from 41% to 84% in ordinary coding workflows.
  • The attacks affected both Cursor and GitHub Copilot, and they stayed effective across 5 codebases and model backends including Cursor auto mode, Claude Sonnet 4, and Gemini 2.5 Pro.
  • The tested payloads covered 70 MITRE ATT&CK techniques, including discovery, credential search, exfiltration, account creation, authentication changes, and persistence.
  • A cited OWASP example found that 3 hidden markdown lines in an imported skill file could make an agent exfiltrate SSH keys.
  • A cited Snyk scan of 3,984 public agent skills found 13.4% with critical security issues, and 91% of confirmed malicious skills combined prompt injection with traditional malware.
  • The excerpt cites 14 distinct CVEs across AI coding tools, including cases where attacks triggered before trust dialogs or bypassed command allowlists.

Link