A new wave of vulnerabilities—collectively named IDEsaster—has been discovered in popular AI-powered IDEs and coding assistants, including Cursor, Windsurf, GitHub Copilot, Zed.dev, Roo Code, Kiro.dev, Junie, Cline, and others.
➡️ 24 of these already have CVE identifiers.
🔍 Why it matters:
These flaws allow attackers to combine prompt injection, auto-approved tool calls, and legitimate IDE features to achieve:
- 📤 Data exfiltration
- 💻 Remote code execution (RCE)
- 🧪 Workspace manipulation
- 🛑 Configuration backdoors
Researchers found that every tested AI IDE was vulnerable to universal attack chains that trick the AI model into misusing built-in tools for malicious purposes.
How the attacks unfold
AI-powered IDEs can be hijacked when:
1️⃣ Hidden or invisible prompt injections pollute the model’s context
2️⃣ AI agents auto-approve dangerous file writes or tool executions
3️⃣ Legit IDE features (like write_file, edit_file, workspace JSON configs) are weaponized
Examples include:
- Using prompt injections to force an AI agent to read sensitive files and leak them via remote JSON schemas
- Modifying workspace settings that run malicious binaries
- Editing IDE configuration files to gain automatic code execution
Key recommendations
🔐 Use AI IDEs only with trusted files and MCP servers
🔍 Review external sources for hidden or malicious instructions
🌐 Apply least privilege to LLM tools
📦 Sandbox command execution
🛡 Perform rigorous security testing for leakage, path traversal, and RCE
As AI agents move deeper into enterprise workflows, they significantly expand the attack surface — especially when LLMs cannot distinguish between legitimate instructions and hidden malicious prompts.
Why this matters now
AI-driven development environments are rapidly becoming standard—but they introduce new attack surfaces that traditional IDE security models were never designed for.
Researchers warn that these issues highlight the need for a new security paradigm:
🔐 “Secure for AI” — security designed around how AI features can be abused.
