Researchers at Intezer showed that a poisoned web page could take over AWS Kiro, an AI coding tool, by getting the agent to rewrite the file that governs what it is allowed to run. A prompt injection in fetched content drops custom code into the MCP settings file, which executes the moment the file is saved. The same write to execution path was demonstrated on Kiro's release day in July 2025 by another researcher, who also flagged writing to a Visual Studio Code settings file to allowlist shell commands. AWS added an approval prompt, but only in supervised mode, leaving the default autonomous mode writing the file unprompted.
Security firm Mindgard disclosed an unpatched flaw in Cursor, the widely used AI code editor, that runs code automatically when a developer opens a malicious repository on Windows. When loading a project, Cursor looks for a Git binary in several places, including the workspace itself, so a file named git.exe planted in the repository root gets executed with no click, prompt, or warning, and it re-runs on a cadence while the project stays open. In a proof of concept, a renamed Windows Calculator launched on its own. Mindgard reported it in December and went public after seven months with no fix, so there is no patch and no CVE, only workarounds.
Researchers at Wiz disclosed GhostApproval, a technique that abuses symbolic links to make AI coding assistants write to sensitive files outside the project. A malicious repository includes a symlink named like an innocent file, such as project_settings.json, that actually points to the developer's SSH authorized_keys or shell startup file. When the developer asks the agent to set up the workspace, it follows the link and writes attacker content, such as an SSH key granting passwordless access. The deeper problem is that the approval prompt shows only the harmless filename, not the real target, so the human approves a change they cannot see. Wiz tested six assistants including Claude Code and Cursor.
Researchers have shown an attack, called HalluSquatting, that weaponizes the tendency of AI coding assistants to invent plausible-sounding names for software packages that do not exist. The attackers work out which fake names an AI reliably hallucinates, register those names first on a package registry or GitHub, and upload a trap that instructs the coding agent to install a reverse shell or runs code directly. When the assistant fetches the made-up dependency on a developer's machine, it runs the attacker's payload. Tested against nine AI coding assistants, the technique could let attackers pool compromised developer machines into a botnet for crypto mining, denial-of-service attacks, or ransomware.
Researchers at Cato AI Labs detailed two flaws, dubbed DuneSlide, in the AI code editor Cursor that let a prompt-injection attack break out of the sandbox Cursor uses to contain the commands its agent runs. The attacker never types anything: they plant instructions in content the agent reads on the user's behalf, such as a connected MCP service or a web page. One flaw abuses a working-directory setting to get an attacker path added to the allowed-write list, letting injected commands overwrite the sandbox helper itself and then run with no sandbox. Both are rated 9.8 and are fixed in Cursor 3.0; every earlier version is affected, so users should update.
Wiz Research found a high-severity flaw in Amazon Q Developer, Amazon's AI coding assistant, that let a malicious code repository run commands and steal a developer's cloud credentials simply by being opened. The bug (CVE-2026-12957) lay in how Amazon Q handled Model Context Protocol servers: it read an MCP configuration file from the open workspace and automatically launched the servers it defined. Because those servers run as local processes that inherit the developer's full environment, a single config file committed to a repo could reach AWS keys, cloud tokens, API secrets, and SSH agent sockets, turning a git clone into a full compromise. Amazon has patched the issue and published an advisory.
TrustStrike Labs