The IDE Is the Attack Surface

In December 2025, security researcher Ari Marzouk published the results of a six-month audit of AI coding tools. He called it IDEsaster. 30+ security flaws. 24 CVEs. Every major AI coding tool affected: Cursor, Windsurf, GitHub Copilot, Zed, Roo Code, Junie, Cline, Claude Code. The same agent autonomy that makes these tools productive creates exfiltration and remote code execution primitives.¹

Three chained attack vectors, repeated across every tool: prompt injection to bypass LLM guardrails, auto-approved agent tool calls requiring no user interaction, and legitimate IDE features weaponized for data theft or code execution. The pattern was universal. The defenses were not.

The Trust Gap

According to Check Point Research, Claude Code had an RCE via hooks. CVE-2025-59536, reportedly CVSS 8.7. A malicious .claude/settings.json in a cloned repository defines hooks that execute shell commands. The hooks reportedly fired before the startup trust dialog appeared. Clone an untrusted repo. Run Claude Code. Arbitrary commands execute.²

GitHub Copilot had a filename injection. Tenable researchers found that Copilot appends filenames to user prompts without sanitization. An extremely long filename containing embedded instructions gets parsed by the LLM, which follows the injected commands. Microsoft reportedly declined to fix, stating that "the behavior described aligns with the intended design of workspace trust."³

The trust boundary between "user opened a project" and "user approved this action" does not exist in most AI coding tools. Opening a repository is implicit trust.

The Cascade

The Clinejection incident reportedly demonstrated how a single prompt injection in a triage bot cascades across an entire pipeline. According to security researchers, a malicious GitHub issue title was interpolated directly into Claude's prompt without sanitization. The AI ran npm install from an attacker-controlled fork. Those scripts deployed Cacheract, which floods GitHub Actions cache with junk data to trigger eviction, then claims the vacated keys with poisoned content.⁴

The low-privilege triage workflow shared cache scope with the high-privilege nightly release workflow. Publication tokens were extracted. On February 17, an unauthorized cline@2.3.0 was reportedly published to npm. Live for eight hours. An estimated 4,000 developer machines compromised.⁴

The Speed

Langflow CVE-2026-33017, reportedly CVSS 9.3. According to Sysdig researchers, a POST endpoint processes attacker-controlled flow data containing arbitrary Python via exec() with no sandboxing. No public proof-of-concept existed. Attackers reportedly reverse-engineered a working exploit from the advisory description within 20 hours. CISA added it to the Known Exploited Vulnerabilities catalog on March 25. Federal patch deadline: April 8.⁵

n8n "Ni8mare" was reportedly worse. CVE-2026-21858, CVSS 10.0 according to Cyera Research Labs. Unauthenticated full server takeover of an estimated 100,000 instances via content-type confusion in webhook processing. Change one HTTP header and you can read any file, extract the database, forge admin cookies, and execute arbitrary commands.⁶

The Protocol

The Model Context Protocol — the emerging standard for connecting AI models to external tools — is itself introducing new vulnerability classes. Anthropic's Git MCP Server had a three-vulnerability chain: path traversal, argument injection, and another path traversal. Chained together, they give an attacker RCE through a poisoned README file.⁷

The MCP TypeScript SDK had a race condition in response multiplexing (CVE-2026-25536, CVSS 7.1). In multi-tenant deployments, one user receives another user's tool results. A cross-tenant data exfiltration pathway in the protocol implementation itself.⁸

The No-Code Amplifier

Copilot Studio prompt injection, December 2025. A travel booking agent built by a non-developer on Microsoft's no-code platform. A prompt injection forced it to reveal all capabilities, then exploited a broader-than-intended action to return credit card information for multiple reservations. The same agent's update action changed a $1,000 trip to $0.⁹

The attack surface isn't just professional development tools. It's every employee who dragged and dropped an AI agent into production without input validation.

The Inventory

According to Koi Research, Claude Desktop's Chrome, iMessage, and Apple Notes extensions reportedly ran unsandboxed with full system permissions. Command injection via AppleScript template literals. SSH keys, AWS credentials, browser passwords exposed. An estimated 350,000+ downloads before the fix.¹⁰

The full IDEsaster list, as cataloged in the awesome-ai-agent-attacks repository: data exfiltration via JSON schema in Cursor, Roo Code, and JetBrains Junie. Code execution via settings modification in Copilot, Cursor, Roo Code, and Zed. Workspace configuration exploitation in Copilot, Cursor, and Roo Code. Persistent memory poisoning in Windsurf.¹

When the architecture assumes trust and the environment provides none, the feature is the exploit.