Windsurf IDE Zero-Click Prompt Injection via Embedded File Directives (CVE-2026-30615)
An attacker plants hidden text inside a code comment, Markdown file, or JSON blob. When a developer simply opens that file in Windsurf IDE, the AI assistant reads the hidden text as a command and can be tricked into running tool calls the developer never asked for. No click or approval is needed beyond opening the file.
How the attack works
An attacker crafts a source file, code comment, or Markdown document containing disguised instructions aimed at the AI, using markers like 'AI:' prefixes, fake 'role':'system' JSON fields, SYSTEM override text, invisible Unicode padding, or Windsurf-specific @-mention and <!--windsurf:...--> comment syntax. The attacker gets this file into a developer's workspace, for example via a shared repo, dependency, or pull request. The developer opens the file in Windsurf IDE for normal editing or review. Windsurf feeds the file's contents to its underlying LLM as context, and the model treats the embedded text as a legitimate instruction rather than untrusted data. The model then executes whatever tool calls the injected instruction requests, without further developer interaction.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 1c919b38-b58d-4b67-a2d2-f95c9a77d781
- Severity
- Critical
- CVEs
- CVE-2026-30615
Why it matters
An attacker can trigger unauthorized actions inside a developer's IDE — including arbitrary tool calls — just by getting a booby-trapped file opened, potentially leading to code execution, data exfiltration, or further compromise of the developer's environment.
What you can do
- →Treat any file from an untrusted or external source as capable of steering your AI assistant; review new files before opening them in an AI-integrated IDE.
- →Watch for suspicious markers in incoming code or docs, such as 'AI:' prefixes, embedded 'role":"system' JSON, SYSTEM override text, invisible/zero-width Unicode, or unexpected <!--windsurf:...--> comments.
- →Restrict what tool calls your AI coding assistant can make automatically, and require explicit approval for actions like file writes, network calls, or shell commands.
- →Exclude vendored third-party code, dependencies, and pull-request diffs from automatic AI context inclusion until reviewed by a human.
Known benign look-alikes
- Security research documentation that describes these injection patterns as examples.
- Unit tests inside an AI-security project that intentionally contain injection payloads.
- Educational blog posts or comments explaining prompt injection techniques.