Prompt Injection Payload In Agentic Coding Assistant Input
This detects text designed to hijack AI coding assistants like Claude Code, Copilot, Cursor, Codex, Aider or Windsurf, tricking them into running attacker-chosen commands. The malicious text is hidden in places the assistant reads automatically, such as code comments, fetched files, or results returned by other tools.
How the attack works
An attacker plants text that looks like a system instruction — for example a fake '<system>' tag, a claim that prior instructions are overridden, or an 'ATTENTION AI' block — somewhere the coding assistant will ingest it, such as a code comment, a file it fetches, or output from another tool it calls. Paired with that hijack marker is a concrete harmful instruction: hide this from the user, send credentials or secrets somewhere, or add a persistent backdoor into a shell profile, git hook, CI workflow, or the agent's own config file. When the assistant reads this combined content and then acts on it — running a command or making a tool call that reflects both parts — the injection has succeeded. The rule only flags cases where both the hijack marker and the harmful instruction appear together in the same tool call or command, because either one alone is normal in everyday engineering work.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7b3c1e52-9a4d-4f18-8c61-2d5f0ab7e934
- Severity
- High
Why it matters
If successful, an attacker can get an AI coding assistant to exfiltrate secrets, hide malicious actions from the developer, or plant persistent backdoors in build pipelines, git hooks, or shell startup files — all without the developer knowingly typing the command.
What you can do
- →Review any AI-assistant-generated commands or tool calls that touch shell profiles, git hooks, CI workflow files, or agent configuration files before they run.
- →Treat content fetched by an agent (web pages, package READMEs, tool outputs) as untrusted input and avoid letting the agent auto-execute code derived from it.
- →Restrict what agentic coding tools can do unattended — limit network egress, credential access, and write access to startup/config files.
- →When reviewing flagged events, check whether the content is legitimate security research or documentation before treating it as an active attack.
Known benign look-alikes
- Security engineers authoring or editing Sigma/YARA detection content that quotes injection phrases alongside curl/credential examples (suppressed by filter_rule_authoring and filter_security_taxonomy).
- Red-team and jailbreak evaluation datasets, LLM guardrail regression fixtures and agent-security benchmarks being read, generated or diffed by the assistant (suppressed by filter_eval_dataset).
- Blog posts, threat reports, README and training material that explain prompt injection and include a worked exfiltration example (suppressed by filter_defensive_prose).
- {'Legitimate onboarding docs that address the assistant directly ("Claude': 'always run make lint before committing") - these carry no covert/exfil/persistence directive and therefore do not satisfy the second required signal.'}
- Dotfile bootstrap or provisioning scripts that append to ~/.bashrc or install shell hooks - these carry no instruction-hijack marker and therefore do not satisfy the first required signal.