Researchers Find Over 30 Vulnerabilities in AI Coding Tools That Risk Data Theft and RCE Attacks

Unveiling the IDEsaster: Security Flaws in AI-Powered Coding Environments

Overview of Recent Vulnerabilities

A recent investigation has uncovered over 30 security vulnerabilities lurking within popular AI-powered Integrated Development Environments (IDEs). These vulnerabilities combine innovative features with crucial weaknesses, enabling potential data exfiltration and remote code execution (RCE).

Security experts, led by Ari Marzouk from MaccariTA, have dubbed these vulnerabilities “IDEsaster.” Affected platforms include well-known tools like GitHub Copilot, Cursor, Kiro.dev, Zed.dev, and many more. Alarmingly, 24 of these vulnerabilities have received formal CVE identifiers, highlighting their significance in the cybersecurity landscape.

Surprising Findings in AI IDEs

One of the most striking aspects of this research is the discovery of universal attack vectors that impact every AI development environment examined. Marzouk noted, “All AI IDEs effectively ignore their foundational software’s threat models. They consider existing features safe because they’re established but fail to account for the risks introduced by AI functionalities.”

The research identifies three primary attack vectors common among these AI-driven IDEs:

1. Prompt Injection – Attackers can manipulate a large language model’s (LLM) context to execute their malicious plans.
2. Auto-approved Tool Calls – Certain actions may execute without user consent through an AI agent’s automated capabilities.
3. Exploitation of Legitimate Features – Using valid features in the IDE, attackers can breach security boundaries, resultantly leaking sensitive information or executing unauthorized commands.

Distinguishing the IDEsaster Exploit Chain

The current vulnerabilities offer a new take on attack chains involving prompt injections, differing from previous exploits that relied solely on compromised tools. The core of the IDEsaster risks lies in how these prompt injections affect established features of the IDE, enabling harmful actions like data leaks or command execution.

Techniques for Context Hijacking

Context hijacking can be achieved through various methods. For instance, attackers could use user-added references that may not be visibly discernible but could still be parsed by the LLM. Techniques like manipulating a Model Context Protocol (MCP) server to inject harmful content into legitimate interactions are also noteworthy.

Identified Attack Vectors

Several high-profile vulnerabilities have been tied to the newly discovered exploit chain:

• CVE-2025-49150 (Cursor) and others enable attackers to use prompt injections to read sensitive files, leading to data leaks when the IDE makes unauthorized web requests.
• CVE-2025-53097 (Roo Code) and related vulnerabilities allow attackers to edit IDE settings to execute malicious code.
• CVE-2025-64660 indicates that attack vectors can modify workspace configuration files, facilitating unauthorized command execution.

It’s essential to note that these exploits depend on a key vulnerability: many AI agents automatically approve file changes without user intervention, allowing malicious modifications without any direct action from the developer.

Recommendations for Safe Practices

To mitigate these risks, Marzouk provides some practical guidelines for users of AI IDEs:

1. Limit Usage to Trusted Files: Only work with projects and files from trusted sources. Be aware that even seemingly innocuous file names can serve as vectors for prompt injection.

2. Carefully Monitor MCP Servers: Regularly check and understand the data flow associated with MCP servers. Even trusted sources can become compromised, so vigilance is necessary.

3. Review Added Sources for Hidden Influences: When integrating external references (like URLs), ensure thorough scrutiny for any hidden malicious scripts.

Safeguarding AI Tools Moving Forward

Developers of AI tools are urged to implement stringent security protocols, such as adopting the principle of least privilege for LLM tools, hardening system prompts, and enhancing their defenses against command injections and information leaks.

Concluding Insights on Emerging Risks

As AI tools become increasingly prevalent in development environments, they widen the attack surface of coding machines. This vulnerability partially stems from an LLM’s difficulty in differentiating between user-provided instructions and potentially harmful content from external scripts.

Aikido researcher Rein Daelman emphasizes that any repository leveraging AI for various tasks, be it issue triage or code suggestions, is at risk of grave security breaches.

Marzouk further highlights the need for a new security paradigm, termed “Secure for AI,” which focuses on designing systems that are not only secure by default but also account for the unique challenges posed by AI integration.

This landscape of vulnerabilities underscores a pressing need for continuous improvement and adaptation in cybersecurity strategies as we navigate the complexities of ever-evolving AI technologies in our development workflows.