← Back to Library

"Your AI, My Shell": Demystifying Prompt Injection Attacks on Agentic AI Coding Editors

Authors: Yue Liu, Yanjie Zhao, Yunbo Lyu, Ting Zhang, Haoyu Wang, David Lo

Published: 2025-09-26

arXiv ID: 2509.22040v1

Added to Library: 2025-12-08 18:02 UTC

Red Teaming

📄 Abstract

Agentic AI coding editors driven by large language models have recently become more popular due to their ability to improve developer productivity during software development. Modern editors such as Cursor are designed not just for code completion, but also with more system privileges for complex coding tasks (e.g., run commands in the terminal, access development environments, and interact with external systems). While this brings us closer to the "fully automated programming" dream, it also raises new security concerns. In this study, we present the first empirical analysis of prompt injection attacks targeting these high-privilege agentic AI coding editors. We show how attackers can remotely exploit these systems by poisoning external development resources with malicious instructions, effectively hijacking AI agents to run malicious commands, turning "your AI" into "attacker's shell". To perform this analysis, we implement AIShellJack, an automated testing framework for assessing prompt injection vulnerabilities in agentic AI coding editors. AIShellJack contains 314 unique attack payloads that cover 70 techniques from the MITRE ATT&CK framework. Using AIShellJack, we conduct a large-scale evaluation on GitHub Copilot and Cursor, and our evaluation results show that attack success rates can reach as high as 84% for executing malicious commands. Moreover, these attacks are proven effective across a wide range of objectives, ranging from initial access and system discovery to credential theft and data exfiltration.

🔍 Key Points

  • Introduction of prompt injection attacks specifically targeting agentic AI coding editors, which allow attackers to hijack the functionality of these systems to execute malicious commands.
  • Development of AIShellJack, an automated testing framework that contains 314 unique attack payloads based on 70 techniques from the MITRE ATT&CK framework, enabling large-scale evaluation of AI coding editors' vulnerabilities.
  • Empirical analysis showing that attack success rates can be as high as 84% for executing malicious commands, indicating serious security risks associated with agentic AI coding editors like GitHub Copilot and Cursor.
  • Identification of a new attack surface where attackers can manipulate external resources (like coding rule files) to inject malicious commands into AI coding editors without user consent.
  • Demonstration of technical weaknesses across different AI coding editors and language models, highlighting the urgent need for enhanced security measures in AI-assisted software development.

💡 Why This Paper Matters

This paper provides valuable insights into the security vulnerabilities of agentic AI coding editors, making a significant contribution to the understanding of prompt injection attacks within a practical context. By revealing the extent of these vulnerabilities and the ease with which they can be exploited, it emphasizes the need for developers and AI tool vendors to address security in their design and deployment practices. The findings stress the importance of implementing robust security measures to protect against unauthorized command execution, ultimately ensuring safer and more reliable AI-assisted development environments.

🎯 Why It's Interesting for AI Security Researchers

This paper is particularly relevant to AI security researchers as it uncovers a novel type of vulnerability that can have profound implications in software development. The identified prompt injection attacks present critical risks that could lead to unauthorized access and manipulation of developer environments, raising concerns about the security of widely used AI tools. The development of AIShellJack as a methodology for assessing these vulnerabilities not only aids in future research but also initiates a dialogue on the necessary defenses against such malicious techniques in AI applications.

📚 Read the Full Paper

📄 View on arXiv 📎 Download PDF