AI agent threats, explained clearly.
Real attacks against AI coding agents, MCP servers, and developer tools. Each advisory breaks down how the attack works, how to spot it, and how to block it.
22
Active advisories
6
Threat categories
14
Affected tools
22+
With detection steps
Browse advisories
Click any advisory to see the full attack breakdown, detection steps, and Guard configuration.
npm postinstall script abuse in AI coding environments
Malicious npm packages use postinstall scripts to execute arbitrary code during installation. In AI coding environments, these scripts can modify agent configuration, install backdoor MCP servers, or exfiltrate project secrets — all before the developer reviews the package.
Environment file exfiltration via webhook
AI agents can be tricked into reading .env files and sending their contents to external endpoints through tool calls, webhook integrations, or HTTP requests that appear legitimate.
CI/CD pipeline poisoning via agent-written config
AI agents that write CI/CD configuration files (GitHub Actions, GitLab CI, CircleCI) can introduce backdoors — injecting steps that exfiltrate secrets, modify artifacts, or deploy malicious code — that execute on every build.
MCP tool description poisoning
Malicious MCP tool descriptions embed hidden instructions that redirect AI agents into calling the wrong tool, exfiltrating secrets, or executing unintended commands — even when the tool itself appears harmless.
Prompt injection via issue comments and pull requests
Attackers embed hidden instructions in GitHub issues, PR comments, and commit messages. When an AI agent reads these to help triage or review, it follows the embedded instructions — potentially approving malicious code or leaking repository secrets.
Agent-readable config file poisoning
AI agents read configuration files like CLAUDE.md, .cursorrules, and AGENTS.md as trusted context. An attacker who can modify these files — via a compromised dependency, a malicious collaborator, or a typo in a path — gains the ability to inject persistent instructions the agent follows on every session.
Destructive command execution via injected instruction
Prompt injection can cause AI agents to run destructive shell commands like rm -rf, git push --force, or database drops — by embedding instructions in files, issues, or tool descriptions.
Gitignore bypass via agent file reads
AI agents can read files that are gitignored — secrets, private keys, and internal configs — because gitignore only prevents git tracking, not file system access. These files often contain the most sensitive data in a repository.
MCP authentication token theft via headers
MCP servers that accept authentication tokens in headers can leak those tokens if the server logs requests, shares telemetry, or is compromised. Tokens passed to MCP servers persist in server-side logs and may be accessible to attackers.
Malicious skill with hidden prompt injection
AI agent skills (Claude Code skills, Cursor rules, Copilot extensions) can contain hidden prompt injections in their instructions. When the skill is loaded, the hidden prompt executes on every session that uses the skill.
Indirect prompt injection via web content
When AI agents fetch web pages — documentation, Stack Overflow answers, package READMEs — the fetched content can contain hidden instructions that the agent follows, potentially exfiltrating data or executing unintended actions.
Agent identity spoofing via system prompt mimicry
Attackers can craft content that mimics system prompts or tool outputs, tricking the agent into believing it received instructions from the harness, the user, or a trusted tool — when the instructions actually came from untrusted data.
Dockerfile injection via AI agent writes
When AI agents write or modify Dockerfiles, prompt injection can cause them to add malicious instructions — pulling attacker-controlled base images, exfiltrating build secrets, or installing backdoors that persist across all container builds.
Shadow MCP server discovery and persistent access
MCP servers added to a project during development can persist in configuration files and maintain access to the agent’s context window long after they are forgotten. These "shadow" servers continue receiving tool calls and may be modified by attackers who compromise the original server.
Context window scraping via long file reads
AI agents that read large files can leak proprietary code, internal documentation, and customer data into their context window — which may then be sent to external LLM APIs or logged in cloud telemetry.
Cross-workspace credential leak via monorepo traversal
AI agents in monorepo environments can read credentials, configs, and secrets from adjacent workspaces — leaking data across team boundaries.
Clipboard and terminal buffer injection
Attackers can plant hostile instructions in clipboard contents or terminal scrollback buffers. When an AI agent reads terminal output or the user pastes clipboard content, the hidden instructions execute as if they came from the user.
Tool permission creep in AI agents
AI agents accumulate tool permissions over time as developers approve new tools "just this once." These permissions persist across sessions, creating an ever-widening attack surface where tools that were approved once can be used by prompt injection in future sessions.
Model confusion via conflicting instructions
When an AI agent receives multiple conflicting instructions — from the user, the system prompt, tool descriptions, and file contents — it may follow the wrong one. Attackers exploit this by planting instructions that conflict with the user's actual intent.
Excessive file reading during project exploration
When AI agents explore a project to understand its structure, they often read dozens or hundreds of files — far more than needed for the task. This excessive reading can expose secrets, proprietary code, and customer data that enter the context window and model API.
Stale dependency exploitation in AI environments
AI agents often work with projects that have outdated dependencies. When an agent suggests or installs packages based on a stale package.json, it can introduce known-vulnerable versions — and in AI environments, the vulnerability is amplified because the agent can execute commands.
Token cost amplification via context flooding
Attackers can craft content that causes AI agents to consume excessive tokens — by inserting large files, repetitive instructions, or recursive prompts that bloat the context window. This inflates API costs and can cause rate-limit denial of service.