Prompt Injection Risks in Agentic Code Workflows

On April 24, 2026, a Cursor agent running Claude Opus 4.6 deleted PocketOS's production database in nine seconds. It had found a Railway token in an unrelated file with permissions covering the entire API, and in an attempt to "fix" a credential mismatch in staging, it deleted a volume instead. The most recent recoverable backup was three months old. That incident is the clearest illustration of why prompt injection in agentic code workflows is not the same risk as prompt injection in a chatbot: the failure mode is no longer a bad paragraph of text, it is an action against infrastructure that cannot be undone.

Prompt injection in agentic code workflows versus chatbots

Agentic coding tools read files, run shell commands, call external APIs, manage Git history, and connect to outside services through protocols such as MCP. A chatbot answers a question. A coding agent acts on a codebase and the infrastructure behind it, so a successful manipulation does not just produce a harmful sentence, it produces a harmful action: a deleted volume, a pushed commit, a leaked credential. The capability that makes these tools valuable (the ability to scaffold a full-stack application, triage a CI pipeline, or fix a production incident autonomously) is the same capability an attacker turns toward credential theft, reverse shell deployment, or source code exfiltration once the agent's instructions have been hijacked, according to the Cloud Security Alliance's research note on AI coding assistants as attack surface.

The root cause sits below the application layer: it's in how the model itself processes text. A large language model has no structural way to separate a developer's instruction from a stray sentence buried in a file it happens to read: both arrive as the same undifferentiated natural-language input. SQL injection, by contrast, has a real fix. Parameterized queries separate code from data at the database layer, closing the vulnerability structurally. Prompt injection has no equivalent. There is no syntactic boundary inside the model that marks one span of text as trusted instruction and another as untrusted content, so every mitigation available today operates one layer up, at the application or context level, rather than at the model itself, as Atlan's 2026 analysis of prompt injection attacks on AI agents documents.

That absence of a structural fix is why NIST has called prompt injection "generative AI's greatest security flaw," and why OWASP ranks it LLM01:2025, the top entry in its Top 10 for LLM Applications, a ranking detailed in Maloyan and Namiot's systematic analysis of prompt injection attacks on agentic coding assistants. Safety instructions placed in a system prompt do not change this calculus once an agent has been compromised. Those instructions operate inside the same reasoning substrate the attacker has already manipulated, so they carry no more authority than any other text the model is processing, a point made in the PARALLAX paper on architecturally safe autonomous execution. Guardrails written in natural language cannot police an attack delivered in natural language, because both are competing for the same model's attention with no referee between them.

The damage a successful injection can cause scales directly with what the agent is allowed to touch. A chatbot's worst case is a harmful or embarrassing output. A coding agent's worst case is whatever its shell access, Git permissions, and MCP connections allow, and in the PocketOS case, that included an entire production database, gone in nine seconds because the agent held permissions far broader than the task in front of it required.

Indirect prompt injection in agentic workflows through content the agent reads as part of its job

The defining feature of this attack class is that the attacker does not need to type anything into the agent's chat window. The payload is embedded in content the agent was already going to read as part of doing its job: repository files, issue descriptions, code comments, the responses returned by tools it calls. Both a planted instruction and the legitimate project context around it look identical at the level the model processes them, so the agent has no reliable way to tell them apart.

Maloyan and Namiot's systematic analysis identifies three primary delivery vectors specific to code workflows. The first is repository content itself, including configuration files, code comments, README files, and issue descriptions, any file an agent reads to build context about a project before starting work. The second is tool responses: the output returned by MCP servers, linters, formatters, or other tools the agent invokes routinely during a task. The third is supply chain artifacts: skills, extensions, and third-party packages pulled from public registries and marketplaces. A fourth pattern distinct from the first three is stored prompt injection, where malicious instructions sit dormant in long-term memory, indexed documents, or knowledge bases until the agent retrieves that content later, during a task that has nothing to do with where the payload was originally planted, as Sysdig's prompt injection guide describes. Any external source an agent can reach counts as a potential vector, and in a codebase wired into Jira, Linear, issue trackers, and internal documentation systems, that reachable surface grows very large, very quickly.

Two documented incidents show what this looks like outside the abstract [1][19]. The Miasma Worm, identified on June 5, 2026, began with a compromised contributor account pushing a commit to Azure/durabletask. That commit planted configuration files that executed a credential harvesting payload the moment a developer simply opened the repository, not when they cloned it, in Claude Code, Gemini CLI, Cursor, or VS Code. For Claude Code specifically, the trigger was a .claude/settings.json Opening a project folder, something developers do dozens of times a day without a second thought, was enough to fire the .claude/settings.json SessionStart hook payload.

The IDEsaster research campaign broadened the picture considerably. Researcher Ari Marzouk found vulnerabilities across ten or more products and ultimately had 24 CVEs assigned, with every single tool tested found exploitable. Three techniques stood out as particularly effective. Remote JSON Schema Exploitation works by having an injected prompt instruct the agent to write a JSON file that references an attacker-controlled schema URL, which the IDE then fetches automatically and without asking. IDE Settings Overwrite has the agent modify .vscode/settings.json to redirect linters and formatters toward attacker-controlled endpoints. A third technique involved MCP tool responses directly, and that is the mechanism the next section takes up in full.

Beyond single-shot payloads, goal hijacking extends the threat into multi-step and multi-agent pipelines. So an attacker can redirect the entire objective an agent is working toward, instead of just triggering one isolated harmful action. In a pipeline with several agents operating in sequence, a hijacked agent passes the compromise downstream, poisoning shared memory, manipulating an orchestrator's decisions, or feeding corrupted instructions to agents further along the chain. A single planted sentence, in other words, does not need to stay contained to the task where it was first read.

MCP's amplification of injection from a local nuisance into a cross-system attack

MCP is the mechanism that turns a repository-level injection into an organization-wide incident. Once an agent has been manipulated, it can use whatever MCP connections it holds to reach databases, internal tools, and credential stores that the original payload never touched directly. The protocol gives agents a single point of access to a wide range of resources, including sensitive databases and internal services, and a compromised MCP server can function as a bridge into all of them, stepping around the perimeter security an organization built for a different threat model entirely, as the CSA research note describes.

Over-permissioning is the structural weakness that produces this: a single token or role with excess reach is what lets an injection escalate into a cross-system attack. If a single MCP token carries blanket access across multiple systems, then once an injection gains control of that token, the attack can cross boundaries the original payload never named or aimed at. Invariant Labs documented exactly this pattern in 2025 with what it called the "Toxic Agent Flow": a developer's agent read a GitHub issue through the GitHub MCP server, and instructions buried in that issue sent the agent into the user's private repositories, then back out through a pull request opened in a public repo. The server's token carried blanket access across both the private and public repositories, so once the agent had been told to cross that boundary, nothing in the system stopped it.

Local MCP servers compound the exposure differently. Many run directly on a developer's machine with full access to the host, and many are built to execute operating system commands or run scripts when the model instructs them to. Where that execution path is implemented carelessly, the server becomes vulnerable to command injection, where malicious input gets interpreted as executable code.

MCP's role as an amplifier is visible at the scale of entire developer ecosystems, not just single sessions. The ClawHub skills marketplace, the largest public skills registry associated with OpenClaw with secondary integration support for Claude Code workflows, suffered a coordinated malicious skills campaign known as ClawHavoc. Koi Security's initial audit identified 341 confirmed malicious entries, 335 of them from a single coordinated campaign, and subsequent analysis raised the confirmed total to at least 824. The CSA research note found that these skills delivered commodity infostealers and reverse shells directly to developer workstations. A developer installing what looked like a routine productivity skill was, in a growing number of documented cases, installing malware instead.

The TrustFall research, published by Adversa AI, demonstrates a related failure in how trust decisions get made. Four agentic coding CLIs, Claude Code, Gemini CLI, Cursor CLI, and Copilot CLI, all execute project-defined MCP servers the moment a developer accepts a folder trust prompt, provided the repository ships MCP-enabling project-scoped settings such as enableAllProjectMcpServers in .claude/settings.json. A single click, made in good faith by a developer opening a project folder, hands project-defined code execution to whatever the repository's configuration specifies. On CI runners where Claude Code runs headless, the default configuration for the official claude-code-action, the trust dialog does not appear at all, so the identical attack runs against pull-request branches with no human in the loop whatsoever. Anthropic acknowledged the report but declined to treat it as a vulnerability, characterizing execution after the trust dialog as functioning as designed.

MCP's update model adds a final layer of difficulty: a server judged safe at the moment of installation can turn malicious through a later update, with neither the agent nor the developer in a position to notice the change. The NSA has addressed MCP specifically on this point, stating that the protocol's power comes paired with significant and evolving security concerns, spanning serialization risks, prompt injection, trust boundary weaknesses, weak access controls, and limited output filtering.

The specific CVEs and attack patterns that show what a successful injection does to a codebase

The CVE record for agentic coding tools maps onto four concrete categories of damage once an injection succeeds: credential exfiltration, persistent backdoor installation, cross-repository boundary crossing, and irreversible action against infrastructure. None of these are theoretical; each has a named incident or assigned CVE attached to it.

Credential exfiltration is documented directly in CVE-2025-55284, affecting Claude Code before version 1.0.4. Injected prompts bypassed the tool's confirmation prompts entirely, so an attacker could read file contents such as .env files and exfiltrate them over DNS, a channel that doesn't look like data leaving the system to most standard monitoring. A separate pattern, which Tenet Security named Agentjacking, works through a far more mundane interaction: a developer asks Claude Code to fix unresolved Sentry issues, and the agent, in the course of doing that work, runs an attacker's command under the developer's own privileges. Tenet reported an 85% success rate for this attack across Claude Code, Cursor, and Codex, and identified thousands of organizations whose Sentry DSNs would accept injected events. Sentry acknowledged the report but declined to implement a structural fix.

The IDEsaster findings identify persistent backdoor installation through the IDE Settings Overwrite technique, which plants redirections inside .vscode/settings.json that survive well past the session in which they were planted, continuing to redirect linters and formatters toward attacker-controlled endpoints for every developer who opens that project afterward.

GhostApproval, published by Wiz in July 2026, demonstrates the fourth category most clearly: irreversible or deceptive action enabled through a UI the developer trusted. The pattern exploits symbolic link following (CWE-61) alongside UI misrepresentation (CWE-451), and it affected six widely used AI coding assistants, Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf, with severity ranging from Critical to High depending on the product. Three vendors patched quickly: AWS, Cursor, and Google. AWS fixed the issue in language server version 1.69.0, which it deployed May 27, 2026, and the flaw was assigned CVE-2026-12958. The UI misrepresentation component made this pattern especially dangerous: the agent displayed an approval prompt that looked legitimate to the developer reviewing it, while the action actually being approved was something else. A developer clicking "approve" believed they were authorizing one operation and were, in fact, authorizing another, which collapses the one safeguard, human review before execution, that the rest of this architecture depends on.