Every Major AI Coding Tool Has Been Hacked
Cursor. Claude Code. GitHub Copilot. Windsurf. Gemini CLI. Codex. Security researchers have found exploitable vulnerabilities in all of them. Here is the complete timeline, the CVEs and why the attack surface is structural, not incidental.
This is not theoretical
In August 2025, independent researcher Johann Rehberger published one new vulnerability per day across ChatGPT, Codex, Claude Code, Cursor, GitHub Copilot and Google Jules. Simon Willison called it "The Summer of Johann."
In March 2026, Mindgard audited 15 major AI coding tools and found 37 confirmed vulnerabilities distilled into 25 repeatable attack patterns across four categories: arbitrary code execution, prompt injection, data exfiltration and trust persistence. Every finding led to remote code execution, data theft or sandbox bypasses in shipping products used by millions of developers.
Cursor
Case-sensitivity bypass for MCP config protection
Cursor's file protection checked for .cursor/mcp.json using exact case matching. On macOS and Windows (case-insensitive filesystems), writing to .cUrSoR/mcp.json bypassed all confirmation prompts. The OS treated it as the same file.
Combined with a malicious Google Doc shared via MCP server, this enabled zero-click remote code execution. An attacker could inject a complete MCP config that ran arbitrary commands on the developer's machine without any approval dialog.
Fixed in Cursor 1.7. Read Lakera's disclosure →
Persistent RCE via MCP config swap
A malicious MCP server could swap in a poisoned MCP configuration file after the user's initial approval. Once approved, the server had persistent code execution capabilities in Cursor. The user approved a safe-looking tool on day one; by day two it was running arbitrary commands.
Hidden instructions in .cursorrules
Pillar Security discovered that invisible Unicode characters (zero-width joiners, bidirectional text markers) could embed malicious instructions in .cursorrules files. A rules file appearing to say "Follow HTML5 best practices" contained hidden text instructing the AI to add external scripts and bypass safety checks.
Cursor told Pillar the issue was "not a vulnerability" on their side. The implication: users must manage the risk themselves.
Claude Code
RCE and API key exfiltration via project files
Claude Code's configuration files (.claude/settings.json, hooks, MCP configs, environment variables) in untrusted repositories could execute arbitrary shell commands. The ANTHROPIC_BASE_URL variable could be overridden in project config to redirect all API calls, including the plaintext API key in the Authorization header, to attacker-controlled servers.
Patched by Anthropic. Read Check Point's disclosure →
Data exfiltration via DNS requests
Claude Code's pre-approved commands (ping, nslookup, host, dig) could be used to exfiltrate data via DNS requests. Sensitive data was base64-encoded and sent as subdomain queries to attacker-controlled DNS servers, bypassing the approval system entirely.
Patched by Anthropic. Read Rehberger's writeup →
Three prompt injection CVEs in one MCP server
Security researchers found three prompt injection vulnerabilities in Anthropic's own official Git MCP server. An attacker only needed to influence what the AI assistant reads: a malicious README, a poisoned issue description or a crafted commit message. No credentials or system access required.
Anthropic removed the git_init tool entirely as part of the fix. If the organization that created Claude cannot ship a secure MCP server, the bar for third-party servers is clear.
Fixed December 2025. Read The Hacker News coverage →
GitHub Copilot
RCE via prompt injection auto-approve escalation
A prompt injection attack could trick GitHub Copilot into editing ~/.vscode/settings.json to set "chat.tools.autoApprove": true. After that, Copilot could execute any command without user approval. One prompt injection permanently disabled the safety guardrail.
GITHUB_TOKEN leak via issue comment injection
In GitHub Codespaces, attackers injected malicious Copilot instructions in GitHub issue descriptions using HTML comments (invisible in the rendered view). When a developer asked Copilot about the issue, the hidden instructions triggered the agent to exfiltrate the user's GITHUB_TOKEN to an external endpoint.
The agent skills ecosystem
MedusaLocker ransomware via a "GIF Creator" skill
In December 2025, Cato Networks researcher Inga Cherny modified the widely-shared "GIF Creator" Claude skill by inserting a function that downloads and executes remote code. It pulled in MedusaLocker ransomware without being flagged by any safety mechanism. The skill passed approval and executed end-to-end in a controlled environment.
With Anthropic serving 300,000+ business customers, one malicious skill approved by one employee could trigger a multimillion-dollar ransomware incident.
ClawHavoc: 1,184 malicious skills on ClawHub
In January 2026, Koi Security discovered a coordinated attack distributing the Atomic (AMOS) macOS stealer through poisoned agent skills. Initial analysis found 341 compromised skills; subsequent scans revealed 1,184+ confirmed malicious packages. Snyk's ToxicSkills study found 36.82% of all skills on the platform had at least one security flaw.
The publishing barrier: a SKILL.md markdown file and a one-week-old GitHub account. No code signing. No security review. No sandbox.
"Your AI, My Shell": 84% attack success rate
Academic researchers published "Your AI, My Shell", the first empirical analysis of prompt injection attacks on agentic coding editors. Their AIShellJack framework generated 314 attack payloads covering 70 MITRE ATT&CK techniques. The attack success rate reached 84% for executing malicious commands.
This is not a theoretical framework. It is a reproducible benchmark showing that the majority of prompt injection attacks against AI coding tools succeed with even simple strategies.
The pattern is structural
These are not isolated bugs from careless vendors. They share a common architecture: AI agents that trust text from untrusted sources. A malicious README. A crafted issue description. A poisoned rules file. A modified tool description. Every exploit follows the same shape.
The underlying problem is that AI coding tools must read project files, documentation and tool descriptions to be useful. But reading means trusting. And trusting means an attacker who can influence what the AI reads can influence what the AI does.
Simon Willison identified the root cause early: tool descriptions are visible to the AI but not displayed to users, creating a hidden instruction channel. The Lethal Trifecta (private data + untrusted content + external communication) is practically the default configuration of any AI coding tool with MCP servers enabled.
Timeline
| Date | Tool | Finding | By |
|---|---|---|---|
| Mar 2025 | Cursor, Copilot | Rules File Backdoor | Pillar Security |
| Apr 2025 | MCP ecosystem | Tool description prompt injection | Simon Willison |
| Apr 2025 | WhatsApp MCP | Cross-server data exfiltration | Invariant Labs |
| May 2025 | GitHub MCP | Private repo exfil via public issue | Invariant Labs |
| Mid 2025 | Cursor (Supabase) | SQL injection via support tickets | Community |
| Jun 2025 | Asana MCP | Customer data bleed across instances | Asana |
| Jun 2025 | MCP servers | NeighborJack: 0.0.0.0 binding | Backslash Security |
| Aug 2025 | Multiple tools | "Month of AI Bugs" (30 vulns) | Johann Rehberger |
| Sep 2025 | AI coding editors | AIShellJack: 84% attack success | Academic paper |
| 2025 | Cursor | CVE-2025-59944 + MCPoison | Lakera / Check Point |
| 2025 | Copilot | CVE-2025-53773 + RoguePilot | Rehberger / Orca |
| 2025 | mcp-remote | CVE-2025-6514: shell injection (437K downloads) | JFrog |
| Dec 2025 | Claude Skills | MedusaLocker ransomware via skill | Cato Networks |
| Dec 2025 | Anthropic Git MCP | 3 prompt injection CVEs | Researchers |
| Jan 2026 | ClawHub | 1,184 malicious agent skills | Koi Security |
| Feb 2026 | Claude Code | CVE-2025-59536: RCE via project files | Check Point |
| Mar 2026 | 15 AI IDEs | 37 vulns, 25 attack patterns | Mindgard |
What to do about it
Patching individual CVEs is necessary but insufficient. The attack surface is structural. Every AI coding tool that reads untrusted text will have prompt injection vulnerabilities. Every MCP server ecosystem without signing will have supply chain attacks. Every rules file format without verification will have backdoor campaigns.
The defense has to be structural too:
Deterministic scanning
Pattern matching that cannot be prompt-injected. Catches known attack signatures in rules files, MCP configs and generated code before they take effect.
How CodeMarine hooks work →Cryptographic signing
Ed25519 signatures over MCP tool manifests and agent skill packages. If a tool description mutates after signing, verification fails. Stops rug pulls cold.
Learn about Haldir →Hook-layer enforcement
Pre-write and pre-execution hooks in Cursor, Claude Code, Windsurf, Kiro and Copilot. Every file write, every shell command, every MCP tool call gets scanned before it runs.
See platform integrations →Further reading
- The Summer of Johann: One Vulnerability Per Day - Simon Willison
- MCP Has Prompt Injection Security Problems - Simon Willison
- The Lethal Trifecta for AI Agents - Simon Willison
- How Hackers Can Weaponize Code Agents - Pillar Security
- A Timeline of MCP Security Breaches - AuthZed
- AI Coding Tools Weaponized: What AppSec Teams Need to Know - ReversingLabs
- Flaws in Claude Code Put Developers' Machines at Risk - Dark Reading
- Weaponizing Claude Skills with MedusaLocker - Cato Networks
- "Your AI, My Shell" - Empirical Analysis of Prompt Injection - arXiv
- MCP Security Vulnerabilities 2026 - Practical DevSecOps
Defend the tools your team already uses
CodeMarine scans AI-generated code, MCP configs, rules files and agent skills with deterministic pattern matching. Hooks into every major AI coding tool.