Disclosed vulnerability
IDEsaster: 30+ vulnerabilities chaining prompt injection to base IDE features across every major AI coding tool
AIR-2025-0190 AIR record · 2025-12-idesaster-ai-ide-class
From the supporting source
100% of tested applications (AI IDEs and coding assistants integrating with IDEs) were vulnerable to IDEsaster.maccarita.com
The record
Disclosed
2025-12-06
Vendor
GitHub/Microsoft; Anysphere; Windsurf; AWS; Zed Industries; Roo Code; JetBrains; Cline; Google; Anthropic
Product
GitHub Copilot; Cursor; Windsurf; Kiro; Zed; Roo Code; JetBrains Junie; Cline; Gemini CLI; Claude Code
Risk domain
Access control and permissions › Privilege escalation
Also touches
Data exfiltration channels, Confused deputy
System type
Generative model
Who acted
Agent acted — the agents wrote IDE config and executed under injection
Attack surface
Coding agent
Autonomy level
Copilot with approval
Initial vector
Indirect prompt injection repo content
Impact type
Remote code execution, Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
every AI IDE and IDE-integrated coding assistant tested - millions of developers
Capability abused
Defense & remediation
Recorded defense
per-tool approval prompts and agent-level guardrails in each product
Guardrail kinds
Human approval
Guardrail outcome
Silent
Fix shipped
Partial - 24 CVEs assigned across vendors; fixes shipped unevenly
Taxonomy & references
Curator notes
Ari Marzouk (MaccariTA), six months of research. The core chain is 'Prompt Injection -> Tools -> Base IDE Features': the agent is steered into using long-standing, pre-AI editor features (task runners, config loading, workspace settings) that were never designed to be driven by an autonomous writer, so the flaw is inherited from the IDE layer rather than any one vendor's agent. This is a class record covering 10+ products, not a single incident; individual CVE numbers were not enumerated on the cited page.
Supporting sources
Cite as
Enkrypt AI. "IDEsaster: 30+ vulnerabilities chaining prompt injection to base IDE features across every major AI coding tool". AIR, AIR-2025-0190. https://agentincident.vercel.app/i/AIR-2025-0190/ (accessed 2026-10-19).