Skip to content
The Injection_
LIVE
LIVElast sweep next in--:--:--

[ RSS ][ JSON ][ llms.txt ]

Coding agents

Also called: AI coding assistants · agentic coding tools

Coding agents are AI tools that read and change code and run commands on a developer's behalf, such as Claude Code, OpenAI Codex, GitHub Copilot's agent and CLI, Gemini CLI and Cursor. They hold a developer's access to repos, terminals and secrets, which makes them a high-value target.

How it works

Coding agents read untrusted content all day: dependencies, issues, pull requests, docs and web pages. Prompt injection in any of it can lead to command execution, secret theft or malicious commits, and plugins, skills and MCP servers extend the attack surface further.

How to defend

Run coding agents in sandboxes or dev containers, keep auto-approve off for untrusted repos, scope tokens, review agent changes like any other contributor's, and keep agents updated.

Real cases 7 stories

  1. HIGH

    Supply chain · AIR Security

    OpenAI Sesame: an official skill sent app tokens to an unowned domain

    OpenAI Sesame is a flaw in render-deploy, an official OpenAI skill that told coding agents Render private services sit at render-internal.com, a domain Render did not own. AIR Security registered it and received live bearer tokens.

  2. MED

    Attack · Adversa AI

    Cryptographic Context Injection leaks secrets from Copilot CLI

    Adversa AI reports that GitHub Copilot CLI in autopilot mode can be made to read local files such as .env.prod and send their contents to an attacker URL, by hiding encrypted instructions in a page the user asks it to fetch.

  3. INFO

    Benchmark · arXiv

    HarnessSecurity-Bench: auto-approve lifts attack success to 95.6%

    HarnessSecurity-Bench tests nine security mechanisms across six coding agent harnesses and reports that enabling auto-approve raises attack success from 29.2% to 95.6%, while command denylisting cut attack effects with a utility gain.

  4. MED

    Vulnerability · JFrog · CVE-2026-104247 · CVSS 6.3

    VTCode: a quoted flag slipped past the agent's find approval check

    VTCode, an open-source terminal coding agent, auto-approved shell commands a token check should have blocked. JFrog reports that an empty quote inside a find flag, written as -exe$''c, kept the command classified as safe. Fixed in 0.171.5.

  5. INFO

    Research · UIUC Kang Lab

    PersistBD: backdoors survive the fine-tuning meant to remove them

    PersistBD is a method showing that a backdoor planted in a third-party model can survive a developer's benign fine-tuning, with the reinforcement learning stage afterwards often preserving or strengthening the hidden behavior.

  6. MED

    Research · arXiv

    Explosive prompts: dormant injections fire on 'thanks' in agents

    Explosive prompts are dormant prompt injections that wait for a harmless trigger such as 'thanks'. A new paper reports 43% to 83% success on nine production agents, versus at most 3% for plain injections, and proposes the DeFuse detector.

  7. HIGH

    Vulnerability · AIR Security

    Plugin4Shell: zero-click plugin RCE in four AI coding agents

    Plugin4Shell is a zero-click remote code execution flaw in how Claude Code, Codex, GitHub Copilot and Gemini CLI install pinned plugins. AIR says Claude Code and Codex are fixed, Copilot is not, and Gemini CLI will not be patched.