Vulnerability / research

IDEsaster chained AI file writes into IDE execution and data leakage

Reported

What happened

Research showed that prompt-injected coding agents could misuse ordinary IDE features, including settings and remote schemas, to expose data or trigger code execution.

Parties and reporting

AI tools and systems: GitHub Copilot, Cursor, Kiro, Roo Code, JetBrains Junie, Zed, Claude Code

Outcome

The researcher reported more than 30 vulnerabilities and 24 CVEs. Vendor responses varied between fixes, warnings, and unresolved cases.

Operating lesson

Treat IDE settings and automatic background features as privileged operations when agents can write files.

Evidence and limits

December 6 dates the aggregate research disclosure; individual component advisories may be older. Results concern tested products and configurations, not every AI editor.

Sources