Skip to content

Back to the catalog

endorlabs.comarticle

Prompt Injection Against Coding Agents: The Attack Surface Nobody Owns | Blog | Endor Labs

Endor Labs breaks down how indirect prompt injection compromises AI coding agents (Cursor, GitHub Copilot) via poisoned READMEs/rules files, malicious MCP servers, and web/issue content the agent reads with elevated trust and auto-approve permissions. Cites a study testing 314 payloads across 70 MITRE ATT&CK techniques showing up to 84% attack success, OWASP's MCP tool poisoning definition, Unit 42's real-world IDPI telemetry, and CVE-2025-52573 as a concrete command-injection-via-prompt-injection case in an MCP server.

TL;DR Overview of how indirect prompt injection via repos, rules files, and malicious MCP servers can hijack AI coding agents into RCE, backdoors, and secret exfiltration.
Open original ↗
Document

What it is

An Endor Labs explainer on indirect prompt injection (IDPI) against coding agents. Beyond the summary's headline claims, it adds several concrete data points worth acting on: MCP ecosystem risk statistics, the fix version for CVE-2025-52573, and the specific injection payload that triggers it.

How it works

The core failure is that an agent cannot distinguish data from instructions. Attacker text placed in any content the agent reads — a README, .cursor/rules, a PR/issue comment, a web page, or an MCP tool's response — gets executed as a trusted command. NIST defines the indirect variant as adversaries who "remotely (i.e., without a direct interface) exploit LLM-integrated applications by injecting prompts into data likely to be retrieved." For CVE-2025-52573, prompt injection is only the delivery mechanism for an underlying command-injection flaw (CWE-78): the LLM is tricked into calling a tool with shell metacharacters such as ; rm -rf /tmp;#, which the MCP server's host then executes.

Preconditions / Affected

  • Coding agents (Cursor, GitHub Copilot cited) with auto-run / auto-approve enabled — the 84% figure comes from tests run with these on.
  • Agents connected to untrusted MCP servers. The page's most actionable new claim: 75% of MCP servers are built by individuals, 82% use sensitive APIs, and 10,000+ were created in under a year (Endor's State of Dependency Management 2025) — i.e. the tool supply you're wiring in is largely unvetted.
  • CVE-2025-52573 affects an MCP server; fixed in v1.3.3.

What to do

The page states no commands or config, so the only hard action items are:

  • Upgrade the affected MCP server to v1.3.3 if in use.
  • Treat MCP servers as untrusted dependencies given the ecosystem stats above; inventory which ones your agents call and whether they use sensitive APIs.
  • Disable auto-run/auto-approve, or gate agent actions (not just prompts) — Endor's stated framing is to control what the agent does, since that is the blast radius.

Caveats

This is a vendor educational post, not an advisory — it offers framing and statistics but no mitigation commands, detection rules, or patch guidance beyond the CVE fix version. The 84% success rate is specific to a study run with auto-approve/auto-run enabled and does not represent default-configuration risk. Unit 42's real-world telemetry is cited as evidence IDPI is "actively weaponized" (22 techniques catalogued), but the underlying dataset is not reproduced here.

CVEs named here

  • CVE-2025-52573

Technologies named here

Techniques named here

Also named here

  • MITRE ATT&CK

Related in AI Security