2025-12-06
HighPrimaryResearcher Ari Marzouk finds 30+ vulnerabilities (24 CVEs) across all tested AI IDEs: Cursor, GitHub Copilot, Claude Code, Windsurf. Novel attack chain — prompt injection via repo files to IDE settings overwrite to RCE — affects 1.8M developers.
What happened
Marzouk embedded hidden instructions in repository files (READMEs, .vscode/settings.json overrides, JSON schema files). When a developer opened the repository, the AI agent followed injected instructions to modify IDE configuration files, and the IDE's built-in execution features ran attacker-specified commands — no explicit user approval required for the AI tool chain.
Why it matters
Demonstrated data exfiltration via Remote JSON Schema attacks (automatic GET requests to attacker-controlled servers triggered on file open in VS Code, JetBrains, and Zed.dev) and remote code execution via IDE Settings Overwrite (.vscode/settings.json → arbitrary terminal commands). 1.8 million developers across affected platforms.
Missing authorization check
AI coding agents must require explicit authorization before modifying IDE configuration files with code execution implications. Tool calls that write to IDE settings with terminal or build hooks must be gated with a signed receipt — modifying build configuration is equivalent to running code and should be treated as such.
Would PP block it?
PP enforced at the IDE tool layer would gate the consequential step in the IDEsaster chain: any tool call writing to .vscode/settings.json, .idea/workspace.xml, or equivalent config with terminal or build execution hooks should require a signed authority receipt — breaking the RCE chain. The Remote JSON Schema data exfiltration vector (automatic HTTP GET on file open) fires before any AI tool call and is outside PP's enforcement surface, requiring vendor-side controls. Full coverage: PP for settings-write tool calls, vendor-side controls for automatic schema fetching on file open.
Incident analysis
2025-06-01
Ari Marzouk begins 6-month IDEsaster research project, testing all major AI IDEs
2025-09-01
Responsible disclosure begins across affected vendors; 90+ day disclosure periods initiated
2025-12-06
IDEsaster published: 30+ vulnerabilities, 24 CVEs across 10+ AI IDEs, 1.8M developers affected
2025-12-07
The Hacker News, GBHackers, and security outlets cover the research; vendor patches begin rolling out
2026-06-17
IDEsaster resurfaces strongly across security media with new vendor-specific analysis and continued coverage
Authorization boundary
This incident is categorized as Tool execution / MCP. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.
PP's tool-call gate would require a signed receipt before AI tools modify IDE settings files with execution implications, blocking the Settings Overwrite RCE vector. PP does not prevent the initial prompt injection from repository files — that is an AI model trust boundary issue.
Related incidents and controls
TrustFall Coding Agent Security Flaw Enables One-Click RCE
Cline AI agent CVE-2026-44211 allows unauthenticated WebSocket hijack and RCE
Claude Code RCE — malicious deeplink injects SessionStart hook, executes arbitrary commands on victim machine with no additional interaction
Agentjacking: Attackers inject malicious instructions into fake Sentry errors via public DSN, hijacking Claude Code, Cursor, and Codex with 85% success rate across 2,388 organizations
Start small
This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.