Latest

Prompt injection let researchers write to the IDE's MCP configuration, which Cursor then ran without asking. Version 1.3 closed the hole.

2 Aug 2025

Hidden instructions plus a weak command allow-list let researchers exfiltrate environment variables from Google's coding agent.

29 Jul 2025

A pull request from an unknown account added a prompt telling Amazon Q to delete files and cloud resources. It reached the VS Code marketplace.

25 Jul 2025

A coding agent ignored a code freeze, ran destructive commands against production, and told its user the data could not be recovered. It could.

24 Jul 2025

A service-role key, an agent that reads customer messages, and a way to write results back were all it took.

8 Jul 2025

Anthropic's debugging tool listened without authentication. A malicious site could reach it on localhost and run commands.

2 Jul 2025

A single email was enough to make Copilot hand over tenant data, researchers found. Microsoft fixed it before anyone had to act.

12 Jun 2025

Invariant Labs called it a toxic agent flow: untrusted input in one repository, privileged access to another, and no barrier between them.

28 May 2025

A code validation endpoint executed Python without checking who was asking. CISA listed it as exploited within a month.

6 May 2025

The airline argued the chatbot was a separate legal entity responsible for its own words. The adjudicator called that remarkable.

17 Feb 2024