Technical Summary: Prompt Injection Attacks on Agentic Coding Assistants

1. Problem Statement

The proliferation of agentic AI coding assistants (e.g., Claude Code, GitHub Copilot, Cursor) has fundamentally altered software development by enabling autonomous agents to read files, execute shell commands, and modify codebases. These systems rely on Large Language Models (LLMs) integrated with external tools and file systems, often via the Model Context Protocol (MCP).

The core security challenge identified is the architectural conflation of code and data. Unlike traditional systems that strictly separate instructions from input data, LLMs process both through the same neural pathways. This makes agents susceptible to prompt injection, where malicious instructions embedded in external content (e.g., repository files, documentation, tool descriptions) manipulate agent behavior. When agents possess system-level privileges, these attacks can lead to arbitrary code execution, credential theft, and supply chain compromise without direct user interaction ("zero-click attacks").

2. Methodology

This paper is a Systematization of Knowledge (SoK) that synthesizes findings from 78 recent studies (published 2021–2026, with a focus on the agentic era from 2024–2025). The methodology involved:

• Literature Review: Aggregating data from arXiv, IEEE Xplore, ACM DL, and USENIX using queries for "prompt injection," "LLM agent security," "MCP vulnerability," and "tool poisoning."
• Inclusion Criteria: Studies were selected if they addressed LLM-integrated systems with tool use, presented novel attacks/defenses, or provided empirical evaluations.
• Meta-Analysis: The authors consolidated statistics on attack success rates and defense bypass rates directly from primary sources, specifically MCPSecBench, IDEsaster, and Nasr et al.
• Scope: The analysis covers 42 distinct attack techniques and 18 defense mechanisms. The authors explicitly state they did not conduct independent replication experiments; their novel contributions lie in the unified taxonomy, skill-specific exploit chain analysis, and defense framework synthesis.

3. Key Contributions

A. A Three-Dimensional Attack Taxonomy

The paper proposes a novel framework categorizing attacks across three orthogonal dimensions:

1. Delivery Vector:
   • Direct: Malicious instructions via primary input (e.g., role hijacking).
   • Indirect: Malicious instructions embedded in external content (e.g., .cursorrules, READMEs, code comments, API docs).
   • Protocol-Level: Exploitation of communication protocols (e.g., MCP tool poisoning, rug pulls, shadowing).
2. Attack Modality:
   • Text-Based: Natural language injection (hierarchy exploitation, encoding obfuscation).
   • Semantic: Meaning-based attacks (cross-origin context poisoning, logic bombs).
   • Multimodal: Non-textual vectors (image, audio, video injection).
3. Propagation Behavior:
   • Single-Shot: One-time interactions.
   • Persistent: Config modification, memory poisoning, or system backdoors.
   • Viral: Self-propagating via repository worms or dependency chains.

B. Skill-Specific Exploit Chains

The paper provides the first systematic analysis of vulnerabilities in skill-based architectures, detailing concrete exploit chains not previously documented:

• Claude Code Skills: Demonstrates how a benign "code-review" skill with Bash access can be triggered by a malicious .cursorrules file to source environment variables, exposing secrets. The vulnerability stems from skills defining tool types but not tool targets.
• Copilot Extensions: Shows how an extension requesting repo:write scope can extract API keys from conversation history and exfiltrate them via a "formatted" commit.

C. Defense Critique and Framework

The authors critically analyzed 18 defense mechanisms, finding that most achieve less than 50% mitigation against sophisticated adaptive attacks. They propose a Defense-in-Depth Framework grounded in identified limitations:

1. Cryptographic Tool Identity: Mandatory digital signing and immutable versioning (ETDI model) to prevent tool squatting.
2. Capability Scoping: Strict least-privilege models (e.g., Meta's "Rule of Two") limiting agents from simultaneously processing untrusted inputs, accessing sensitive data, and changing state.
3. Runtime Intent Verification: Multi-agent pipelines where a "guardian" agent validates actions before execution.
4. Sandboxed Execution: Mandatory containerization with strict egress controls.
5. Human-in-the-Loop Gates: Tiered approval systems for irreversible actions.

4. Key Results and Findings

• High Success Rates: Meta-analysis indicates that attack success rates exceed 85% against state-of-the-art defenses when adaptive strategies (e.g., gradient descent, RL) are employed.
• Defense Inefficacy: Evaluated defenses (e.g., Protect AI, PromptGuard, Model Armor) showed reported bypass rates of <10% in static tests, but these rose to 78–93% under adaptive attack conditions.
• Platform Vulnerabilities:
  • Cursor: Rated "Critical" due to auto-approve flags, unsandboxed MCP servers, and lack of egress controls.
  • GitHub Copilot: Rated "High" due to configuration manipulation vulnerabilities (CVE-2025-53773) and cursory marketplace reviews.
  • Claude Code: Rated "Low" relative to others due to mandatory tool confirmation and sandboxed servers, though still vulnerable.
• Specific Vulnerabilities: The paper catalogs 31 attack techniques, including Tool Poisoning (malicious tool descriptions), Rules File Backdoors (.cursorrules), and Log-To-Leak (covert exfiltration via side channels).
• Fundamental Limitation: The paper concludes that prompt injection is a first-class vulnerability class inherent to the LLM architecture. Unlike SQL injection, which has deterministic syntactic boundaries, prompt injection operates in semantic space where the boundary between instruction and data is undefined and context-dependent.

5. Significance and Claims

The paper asserts that the security community must treat prompt injection as a first-class vulnerability requiring architectural-level mitigations rather than ad-hoc filtering.

• The Capability-Security Tradeoff: The authors argue that there is no clear resolution to the tradeoff where increased agent capability (access to files, shell, web) inherently expands the attack surface. Security improvements necessarily limit functionality.
• The "Attacker Moves Second" Principle: Citing Nasr et al., the paper highlights a fundamental asymmetry: defenders must specify static rules, while attackers can observe and adapt. This suggests that static defenses are inherently insufficient.
• Call to Action: The authors advocate for a shift from detection-based approaches to prevention-based architectures, including cryptographic provenance, fine-grained capability scoping, and multi-agent verification. They emphasize that compromised coding assistants represent a vector for large-scale supply chain attacks, making this a defining challenge for the software ecosystem in the coming decade.

The paper maintains a modest tone regarding its own experimental contributions, clarifying that its primary value lies in the synthesis of existing empirical data, the unification of disparate taxonomies, and the identification of specific exploit chains in emerging skill-based ecosystems.