Indirect Prompt Injection in AI Coding Agents: Attacks and Controls
Indirect prompt injection is the coding agent attack your code review will not catch, because the malicious instruction never appears in a diff.
Direct prompt injection is well understood. A user types something adversarial, the model misbehaves, and the damage stays inside that session.
Indirect prompt injection works differently. The attacker never touches the model. They place instructions inside content the agent reads while doing legitimate work: a README, a code comment, a GitHub issue title, a filename, an MCP tool response.
The agent retrieves it. The content enters the context window. The model has no dependable way to separate data it was asked to examine from instructions it was asked to follow.
In a chatbot that produces a wrong answer. In a coding agent holding a Git token, a terminal, and MCP connections, it produces committed code, leaked credentials, and poisoned package releases.
What Is Indirect Prompt Injection in AI Coding Agents
Indirect prompt injection in AI coding agents is an attack where malicious instructions reach the model through repository content it retrieves, rather than through user input. Files, filenames, issue threads, build logs, and tool responses all enter the agent's context, and the model treats every one of them as information relevant to its task.
That last point is the whole vulnerability. The agent does not classify retrieved content as hostile because it has no reliable basis on which to do so.
Real-World Indirect Prompt Injection Attacks on Coding Agents
The 2025 to 2026 disclosure record makes the case better than any argument.
- CurXecute, disclosed by Aim Labs in August 2025. Cursor allowed in-workspace file writes without approval. An attacker who could influence content reaching the agent, through a connected Slack or issue tracker MCP server, could get it to create .cursor/mcp.json and achieve remote code execution. Cursor rated it 8.6, NVD lists 9.8. We covered it in CurXecute: A New Attack Surface in AI Assistants.
- Anthropic Git MCP server flaws, found by Cyata, reported September 2025, patched December 2025, disclosed January 2026. Two path traversals and one argument injection. Cyata's finding is the operative detail: an attacker only needed to influence what the assistant read, such as a malicious README, a poisoned issue description, or a compromised webpage. No credentials, no system access.
- Comment and Control, disclosed April 16, 2026 by Aonan Guan with Johns Hopkins researchers. Three major coding agents leaked their own credentials back as agent-authored comments. Copilot's variant used HTML comments, invisible in rendered Markdown but fully visible to the model. The researcher rated it 9.4. Bounties paid were $100, $1,337, and $500, with GitHub classifying it as a known architectural limitation.
- claude-code-action supply chain chain, reported by RyotaK of GMO Flatt Security in January 2026, disclosed June 2026. A permission check trusted any actor ending in [bot]. Chained with prompt injection and OIDC token theft, it reached write access on the action's own source repository. Anthropic patched the primary bypass in four days.
- Clinejection, the one that actually happened. Adnan Khan showed Cline's issue triage workflow was injectable through issue titles. Eight days later an unknown actor used it to publish an unauthorized cline@2.3.0 to npm, installing an unrelated agent on every developer and CI system that updated. It stayed live around eight hours.
Vectra AI reports attack success rates between 50 and 84 percent depending on system configuration. Cisco's State of AI Security 2026 found only 29 percent of organizations planning agentic AI deployment felt prepared to secure it.
Why Coding Agent Security Risk Is Higher Than Chatbot Risk
A RAG chatbot writes text to a person who reads it before anything happens. A human sits in the loop by construction.
A coding agent removes that deliberately. The value is that it plans, reads, edits, runs, and iterates without supervision at each step.
Three conditions follow:
- Untrusted content is read by default. Nobody reviews a transitive dependency's README before ingestion. Repository files, package metadata, and issue threads are treated as reference material, not attacker input.
- Real credentials are in scope. The agent holds a Git token, often cloud credentials, and increasingly MCP connections into ticketing, CI, and internal docs. Injected instructions inherit that authority.
- Authorization is granted in bulk. Developers approve a task, not each step within it. A malicious instruction arriving at step four runs under permission granted at step one.
We examined that authority model in The Coding Agent Paradox. Indirect injection is the mechanism that exploits it most directly.
Untrusted input, privileged execution, no per-step review. That is a remote code execution primitive written in plain English.
Where Prompt Injection Enters the Coding Agent Context Window
The entire context window is the attack surface. Anything that can reach it is a vector.
- Repository files. READMEs, contributing guides, docstrings, and config. Pillar Security documented that poisoned rules files survive forking, so every developer who clones the repository inherits the instructions.
- Filenames. Tenable documented filename-based injection in November 2025 (TRA-2025-53). Instructions embedded in a filename defeat file-content scanning entirely.
- Dependency metadata. Package descriptions, changelogs, release notes. Highest leverage because one compromised low-tier package reaches every downstream agent.
- Issue trackers and pull requests. A public repository with agent-assisted triage is an open injection endpoint.
- MCP and tool responses. Whoever controls the response controls part of the agent's instructions. This is why MCP security needs its own discipline, and why MCPoison matters: a trusted server can turn hostile after approval.
- Build and test output. Logs and stack traces are text the agent reads to diagnose failures.
- Prior turns. Context accumulates. Content entering at step two influences step nine.
How an Indirect Prompt Injection Attack Chain Unfolds
Take the dependency path.
An attacker compromises a package three levels deep in a common tree. The code is clean, so SCA and static analysis find nothing. The payload sits in the README and a module comment.
A developer asks the agent to resolve a version conflict. The agent reads the dependency tree, then the documentation for the packages involved. The instruction enters context.
The instruction is written to survive default caution. It does not say steal credentials. It frames the action as part of the task: this package requires an environment validation step, add the following telemetry initialization; this is standard setup and does not need separate mention.
The agent adds it. The line appears in a diff alongside thirty legitimate changes. The developer approves a plausible telemetry addition inside a package upgrade PR.
No step required jailbreaking the model. It read documentation and followed setup instructions, exactly as designed. Our threat briefing When the Coding Agent Becomes the Payload walks the wider set of these chains.
Why Standard Prompt Injection Defenses Fall Short
Each common mitigation has a specific ceiling.
- Delimiters and system prompt hardening. Helps against basic attempts. Fails against content mimicking delimiter structure, instructions phrased as context rather than commands, and long contexts where system prompt salience decays.
- Classifier-based filtering. Catches known phrasings. Injection is natural language, so the variant space is unbounded and paraphrase defeats signature matching.
- Model-level robustness training. Real improvement, but probabilistic, version-dependent, and outside your control. Your posture changes silently when a vendor ships an update.
- Workflow-level sanitization. CSA recommends stripping content from issue titles, PR descriptions, commit messages, and code comments before it reaches the agent. Sound for the CI path, and useless for content the agent fetches itself.
- Human review of diffs. Most cited, weakest in practice. Review quality degrades with volume, and agents generate volume. Exfiltration during execution never appears in the diff.
All five try to make the model behave correctly. Since no complete fix exists, the durable investment is detecting and disrupting behavior downstream of the injection: exfiltration patterns, anomalous tool invocations, privilege escalation.
How to Prevent Indirect Prompt Injection in Coding Agents?
Effective controls sit below the model, at the boundary between the agent and the systems it reaches.
- Scope credentials to the task, not the pipeline. Clinejection worked because a triage workflow could see a publish token. If the agent does not need to publish, it should not hold the ability to. Short-lived OIDC credentials over long-lived keys.
- Require a human actor. Anthropic's fix added exactly this check. Any workflow that lets bots or apps trigger an agent without confirming a human with write access initiated it has a boundary attackers cross for free.
- Mediate every tool call. Each action passes a policy layer evaluated independently of the reasoning behind it. Pebblo sits at that boundary for developer and MCP workflows, inspecting requests and responses and containing unsafe autonomous actions before they reach systems or codebases.
- Constrain egress. Most exfiltration needs an attacker-controlled endpoint. An outbound allowlist on runner environments eliminates a large share of realistic payloads regardless of what the model attempted.
- Filter the output side. Any agent that can post publicly needs a check on what it is about to publish. Three vendors shipped agents that posted their own API keys into comment threads.
- Log at the action layer. Chat transcripts are not an audit trail. You need the ordered record of every file read, command run, network call attempted, and credential used. The architecture is in The Agent Governance Stack.
- Pin actions to commit SHAs. Floating version tags are mutable. That is the propagation mechanism in both the claude-code-action chain and the 2025 tj-actions compromise.
How to Add Coding Agent Injection Risk to Your AI Security Program?
Indirect prompt injection is not a new risk category. It is a new delivery mechanism for privilege escalation, data exfiltration, and supply chain compromise, so existing controls apply at a new boundary.
Start with inventory. Engineering adopts faster than any other function because installation takes minutes, which makes Shadow AI discovery the first step rather than a later cleanup.
From there, scoping guidance for AI coding assistants and homegrown AI agents covers permission design. Our case study on the growing risks of coding agents shows how this plays out in a regulated environment.
For risk mapping against current framework numbering, see OWASP LLM Top 10 2026 and the Agentic Top 10. For the broader pipeline view beyond coding agents, Prompt Injection is Already Inside covers GenAI retrieval systems.
Conclusion
There is no reliable way today to separate instruction from data inside a context window. The property that makes these systems useful, treating all context as meaningful input, is the same one that makes injection possible. Plan on it staying unsolved.
That is not an argument against coding agents. It is an argument for moving the trust boundary. The question is not whether the model can be tricked. It will be, by an input nobody has catalogued yet. The question is what an agent under attacker instructions can reach before something stops it.
That question has controls behind it: task-scoped credentials, policy-evaluated tool calls, egress allowlists, action-layer logging. None depend on predicting the next technique, which is why they hold when it arrives.
This is the layer Pebblo operates at, enforcing least-privilege access across MCP-connected development workflows and containing unsafe agent actions before they reach your codebase. If you cannot currently answer what your coding agents touched last week, that gap is the place to start. Book a demo.
