{
 "public_id": "AIR-2025-0190",
 "incident_id": "2025-12-idesaster-ai-ide-class",
 "date_disclosed": "2025-12-06",
 "date_occurred": null,
 "title": "IDEsaster: 30+ vulnerabilities chaining prompt injection to base IDE features across every major AI coding tool",
 "class": "responsible_disclosure",
 "attack_surface": "coding_agent",
 "initial_vector": "indirect_prompt_injection_repo_content",
 "agent_capability_abused": [
  "file_write",
  "ide_feature_abuse",
  "task_configuration",
  "shell_execution"
 ],
 "target_product": "GitHub Copilot; Cursor; Windsurf; Kiro; Zed; Roo Code; JetBrains Junie; Cline; Gemini CLI; Claude Code",
 "target_vendor": "GitHub/Microsoft; Anysphere; Windsurf; AWS; Zed Industries; Roo Code; JetBrains; Cline; Google; Anthropic",
 "autonomy_level": "copilot_with_approval",
 "impact_realized": false,
 "impact_type": [
  "remote_code_execution",
  "data_exfiltration"
 ],
 "blast_radius": "every AI IDE and IDE-integrated coding assistant tested - millions of developers",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI01",
   "ASI05"
  ],
  "mitre_atlas": [
   "AML.T0051.001"
  ],
  "labels": [
   "vulnerability_class",
   "ide_feature_abuse",
   "auto_approved_actions",
   "cross_vendor"
  ]
 },
 "defense_present": "per-tool approval prompts and agent-level guardrails in each product",
 "defense_bypassed": true,
 "fix_shipped": "Partial - 24 CVEs assigned across vendors; fixes shipped unevenly",
 "primary_sources": [
  "https://maccarita.com/posts/idesaster/"
 ],
 "verified_quote": "100% of tested applications (AI IDEs and coding assistants integrating with IDEs) were vulnerable to IDEsaster.",
 "confidence": "high",
 "notes": "Ari Marzouk (MaccariTA), six months of research. The core chain is 'Prompt Injection -> Tools -> Base IDE Features': the agent is steered into using long-standing, pre-AI editor features (task runners, config loading, workspace settings) that were never designed to be driven by an autonomous writer, so the flaw is inherited from the IDE layer rather than any one vendor's agent. This is a class record covering 10+ products, not a single incident; individual CVE numbers were not enumerated on the cited page.",
 "risk_category": "security_fraud",
 "risk_secondary": [
  "privacy"
 ],
 "risk_subcategory": "Prompt Injection",
 "risk_sub_secondary": [
  "Remote Code Execution & Sandbox Escape"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "the agents wrote IDE config and executed under injection",
 "vector_family": "indirect_prompt_injection",
 "vector_detail": "indirect_prompt_injection_repo_content",
 "guardrail_kind": [
  "human_approval"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [
   "AML.T0051.001"
  ],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI01",
 "agent_framework": "unknown",
 "model_provider": "multiple",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "privilege_escalation",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [
  "data_exfiltration_channels",
  "confused_deputy"
 ],
 "eai_reason": "impact rule: privilege_escalation",
 "asi_curated": [
  "ASI01"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI01 | added ASI05 (impact=code_exec)",
 "submitted_by": "EAI Internal"
}