ShellSieve, an LLM-driven pipeline, detects command denylist fragility in terminal AI agents and finds 69.0-98.6% of 1,709 GitHub-collected denylists to be bypassable.
"Your AI, My Shell": Demystifying Prompt Injection Attacks on Agentic AI Coding Editors
8 Pith papers cite this work. Polarity classification is still indexing.
8
Pith papers citing it
abstract
Agentic AI coding editors driven by large language models have recently become more popular due to their ability to improve developer productivity during software development. Modern editors such as Cursor are designed not just for code completion, but also with more system privileges for complex coding tasks (e.g., run commands in the terminal, access development environments, and interact with external systems). While this brings us closer to the "fully automated programming" dream, it also raises new security concerns. In this study, we present the first empirical analysis of prompt injection attacks targeting these high-privilege agentic AI coding editors. We show how attackers can remotely exploit these systems by poisoning external development resources with malicious instructions, effectively hijacking AI agents to run malicious commands, turning "your AI" into "attacker's shell". To perform this analysis, we implement AIShellJack, an automated testing framework for assessing prompt injection vulnerabilities in agentic AI coding editors. AIShellJack contains 314 unique attack payloads that cover 70 techniques from the MITRE ATT&CK framework. Using AIShellJack, we conduct a large-scale evaluation on GitHub Copilot and Cursor, and our evaluation results show that attack success rates can reach as high as 84% for executing malicious commands. Moreover, these attacks are proven effective across a wide range of objectives, ranging from initial access and system discovery to credential theft and data exfiltration.
citation-role summary
background 1
citation-polarity summary
years
2026 8roles
background 1polarities
background 1representative citing papers
Heimdallr detects seven LLM-induced threat vectors in GitHub CI via L-WPG graphs, triggerability analysis, and hybrid dataflow, with F1 0.917 on 300 labeled workflows and 802 disclosed cases.
LogJack shows indirect prompt injection via cloud logs succeeds in making LLM agents execute remote code on 6 of 8 models, with most cloud guardrails failing to detect the attacks.
Prevalence study of 10k GitHub repos identifies duplication, low revision, and missing permissions in LLM agent configs; proposes Rel(AI)Build control plane with content addressing, tiered permissions, state machine, and Jaccard drift detection.
Mixed-methods study creates taxonomy of AI IDE rules from 7310 instances, analyzes evolution drivers, and reports that rule updates raise average artifact compliance from 49.14% to 72.13%.
Poisoning any single CIK dimension of an AI agent raises average attack success rate from 24.6% to 64-74% across models, and tested defenses leave substantial residual risk.
Agentic AI coding assistants are vulnerable to prompt injection via unvetted external artifacts, enabling attackers to turn them into shells for unauthorized commands.
A synthesis of 247 papers on LLM agent security identifies prompt injection and tool hijacking as dominant threats, notes weakly compositional defenses, and argues for trust boundaries and realistic evaluations.
citing papers explorer
-
One Goal, Many Commands: Characterizing Denylist Fragility in AI Agents
ShellSieve, an LLM-driven pipeline, detects command denylist fragility in terminal AI agents and finds 69.0-98.6% of 1,709 GitHub-collected denylists to be bypassable.
-
Heimdallr: Characterizing and Detecting LLM-Induced Security Risks in GitHub CI Workflows
Heimdallr detects seven LLM-induced threat vectors in GitHub CI via L-WPG graphs, triggerability analysis, and hybrid dataflow, with F1 0.917 on 300 labeled workflows and 802 disclosed cases.
-
LogJack: Indirect Prompt Injection Through Cloud Logs Against LLM Debugging Agents
LogJack shows indirect prompt injection via cloud logs succeeds in making LLM agents execute remote code on 6 of 8 models, with most cloud guardrails failing to detect the attacks.
-
A Deterministic Control Plane for LLM Coding Agents
Prevalence study of 10k GitHub repos identifies duplication, low revision, and missing permissions in LLM agent configs; proposes Rel(AI)Build control plane with content addressing, tiered permissions, state machine, and Jaccard drift detection.
-
Rule Taxonomy and Evolution in AI IDEs: A Mining and Survey Study
Mixed-methods study creates taxonomy of AI IDE rules from 7310 instances, analyzes evolution drivers, and reports that rule updates raise average artifact compliance from 49.14% to 72.13%.
-
Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw
Poisoning any single CIK dimension of an AI agent raises average attack success rate from 24.6% to 64-74% across models, and tested defenses leave substantial residual risk.
-
How Agentic AI Coding Assistants Become the Attacker's Shell
Agentic AI coding assistants are vulnerable to prompt injection via unvetted external artifacts, enabling attackers to turn them into shells for unauthorized commands.
-
Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation
A synthesis of 247 papers on LLM agent security identifies prompt injection and tool hijacking as dominant threats, notes weakly compositional defenses, and argues for trust boundaries and realistic evaluations.