Vulnerability  ·  2026-06-23

Poisoned Coding-Assessment Repository — AI Agent Indirect Prompt Injection Exfiltrates Cloud Credentials in Under 2 Minutes

VulnerabilityHigh impactGlobal
Mitiga Labs published a full attack-chain analysis on 2026-06-22 (datePublished confirmed via JSON-LD in page source) demonstrating how a fake take-home coding assessment repository — containing no traditional malware — uses indirect prompt injection through files that AI coding agents trust by default (CLAUDE.md, .cursor/rules, README, MCP config) to manipulate the agent into harvesting AWS credentials, enumerating cloud and Kubernetes environments, and exfiltrating data in under two minutes. With auto-run enabled, the agent used only legitimate developer tooling. The critical outcome was theft of a long-lived CI/CD service account credential that survived workstation remediation.
This documents a novel, weaponised attack class with a full working PoC against real AI coding agents (Cursor, Claude Code). No malware is dropped — detection by traditional endpoint tools is essentially zero. The attack exploits the fundamental trust model of agentic coding assistants: they read and act on repository context files before any human review. The stolen long-lived credential enables persistent cloud access far beyond the initial workstation compromise, making this a severe supply-chain-style identity attack.
Developer clones or opens a poisoned repository; AI coding agent with auto-run reads instruction files containing hidden prompt-injection directives and autonomously executes credential theft and exfiltration using legitimate tools (AWS CLI, kubectl, etc.).
AI coding agents with auto-run enabled (Cursor, Claude Code, and similar) that process repository context files (CLAUDE.md, .cursor/rules, AGENTS.md, MCP configs)
Disable auto-run / auto-approve mode in AI coding agents; require explicit approval for tool calls. Replace long-lived static credentials with short-lived tokens. Isolate untrusted repositories in sandboxed environments. Audit agent context files (CLAUDE.md, .cursor/rules, MCP configs) before execution. See Mitiga advisory for full IOCs.
Sources
Mitiga — The Take-Home Test: AI Agent–Driven Cloud Account Compromise Through Poisoned Coding Assessments (2026-06-22)Mitiga — AI Agent Supply-Chain Malware in Instruction Files (Skillgate)
See this in the live feed Explore related AI security and governance findings — updated every morning.
Open the feed →