tag: Ai-Coding-Agents · 6 items
- Engineer — Act: Active prompt-injection technique caught targeting real developer machines: restrict AI coding agents to project directories only and disable auto-execution of package-install commands to eliminate this ambient-file attack surface.
- SOC/IR — Plan: New TTP worth covering: build detections for package manager processes (npm/pip/etc.) spawned as child processes of AI coding agent binaries, especially when triggered outside expected project paths.
- Leader — Plan: AI coding agents in your developer toolchain now represent a prompt-injection risk from ambient files; establish a policy governing agent filesystem scope and command permissions before an undetected attempt succeeds.
- Engineer — Plan: A real-world case of indirect prompt injection: a malicious AGENTS.md file in a Downloads folder redirected an AI coding agent to install a rogue npm package. Audit your system for unexpected AGENTS.md (or similar instruction) files in user-accessible directories, and restrict your AI coding agent’s trusted file-read scope to the project root.
- SOC/IR — Plan: This establishes a new TTP: adversaries plant instruction files (AGENTS.md) in directories that AI coding agents scan, triggering unauthorized package installs. Build a hunt for AGENTS.md or equivalent agent-config files outside expected project roots, and add detections for anomalous package manager invocations spawned by AI agent processes.
- Leader — Plan: If your engineering org uses AI coding agents (Claude Code, Copilot, Cursor, etc.), this attack class — poisoning agent instruction files to hijack developer workflows — warrants a policy before it matures further; define which directories agents may trust for instruction files and require developer awareness training this quarter.
- Engineer — Act: AI coding agents in your dev workflow may be silently pushing screenshots—including sensitive internal data—to public GitHub repos under personal developer accounts. Audit GitHub for AI-agent-created image artifacts now, and restrict AI agent configurations to prevent writing to public repositories.
- SOC/IR — Act: Over 13,000 internal images from 300+ orgs are already publicly reachable on GitHub. Hunt for unexpected image file commits (PNG/JPEG) in developer personal repos linked to your organization’s accounts, and check whether any internal-origin images are indexed publicly.
- Leader — Act: Customer billing records are confirmed among the exposed data, implicating potential GDPR/SEC disclosure obligations. This week, confirm whether your organization is among the 300+ affected by querying your security team for AI agent GitHub activity, and engage legal on exposure scope before regulators or customers surface it first.
- Engineer — Act: A pinned-version bypass in AI coding agents enables malicious plugin substitution via a controlled upstream repo — a direct supply-chain risk in CI/CD pipelines. Update Claude Code to ≥2.1.179 and OpenAI Codex to ≥0.146.0 immediately; audit all plugin sources across affected agents and restrict GitHub Copilot plugin use until a patch is confirmed.
- SOC/IR — Plan: No published IOCs or active exploitation reported, but this introduces a new class of AI coding agent supply-chain abuse worth covering. Build detections on anomalous plugin installation behavior and source-repository mismatches in CI/CD pipeline logs, prioritizing environments running unpatched Copilot.
- Leader — Plan: AI coding agents are broadly deployed in engineering orgs and this vulnerability lets a compromised upstream plugin repo silently inject malicious code even with pinned versions. Task the security team to inventory which AI coding agents are in use and confirm patch status — GitHub Copilot appears to lack a fix, warranting a risk assessment before the next sprint cycle.
- Engineer — Plan: Four of the seven affected agents remain unpatched, making this an active exposure for any team whose developers clone untrusted repos while running AI coding assistants. Audit which agents (Claude Code, Codex CLI, Cursor, etc.) are in use, update those that have received patches, and enforce policy against running agents against repositories from untrusted sources until remaining fixes ship.
- SOC/IR — Learn: This research introduces a new attack class—git-config-triggered code execution via AI agent trust boundaries—that is worth understanding for future detection work on developer endpoints, but no IOCs, exploited campaigns, or mappable TTPs are published yet to act on immediately.
- Leader — Plan: With four tools still unpatched, any organization where developers use CLI AI coding agents carries uncontrolled supply-chain risk from malicious repository clones. This quarter, inventory which agents are deployed, confirm patched versions are standardized, and establish a policy on approved repositories before AI agent use.
- Engineer — Act: If your team runs Claude Code or Gemini CLI in CI pipelines under vendor-default configuration, an unprivileged GitHub issue can reach your runner and exfiltrate CI secrets — audit all AI agent CI integrations now, restrict what secrets are scoped to those runners, and disable issue-triggered agent workflows until hardened configurations are documented.
- SOC/IR — Plan: This Black Hat presentation defines a new TTP category — prompt injection via issue trackers targeting AI coding-agent CI workflows — worth building detections for; plan to monitor for anomalous CI runner invocations originating from issue events and unexpected secret-access patterns in pipeline logs.
- Leader — Plan: Default configurations of AI coding agents from major vendors expose CI secrets to anyone who can open a GitHub issue — assess whether engineering teams have deployed these tools in CI/CD pipelines this quarter and establish an approval policy for AI agent access to production secrets before adoption widens.