Skip to content

Back to the catalog

Protestware by open source maintainer to hinder agentic coding: The jqwik 1.10.0 Prompt Injection
snyk.iowriteup

Protestware by open source maintainer to hinder agentic coding: The jqwik 1.10.0 Prompt Injection

Snyk details how jqwik maintainer Johannes Link shipped version 1.10.0 of the Java property-testing library net.jqwik:jqwik-engine to Maven Central with a hidden method, printMessageForCodingAgents(), instructing AI coding agents to delete all jqwik tests and code. The instruction was concealed from humans via ANSI escape codes (ESC[2K + carriage return) that wipe the line on an interactive terminal but leave the text intact in raw logs captured by CI systems and agent tool-output parsers like Claude Code, GitHub Copilot agent mode, and Cursor. Claude Code detected and refused the injected instruction in the wild; the maintainer later disclosed the behavior, softened it in 1.10.1 (opt-in hiding, non-destructive directive), and stated jqwik is not meant for AI-assisted workflows — framing it as deliberate "protestware" against agentic coding rather than a conventional vulnerability.

TL;DR A jqwik maintainer intentionally hid a destructive prompt-injection payload (via ANSI terminal escape codes) in a Maven release to sabotage AI coding agents that read test output.
Open original ↗
Document

What it is

The jqwik prompt-injection incident, released May 25, 2026 as net.jqwik:jqwik-engine version 1.10.0 on Maven Central by maintainer Johannes Link. The existing summary covers the payload; this page adds the timeline, detection steps, and a critical caveat about the "fixed" release.

Preconditions / Affected

Impact requires an agent that folds raw tool output back into its context. The message is only invisible where ANSI codes are rendered (interactive terminals). Anywhere bytes are captured literally — Jenkins, GitHub Actions logs, IDE test-runner panels, and agent wrappers spawning non-PTY subprocesses — the instruction sits in plain text. Affected: any project pulling 1.10.0 directly or transitively, and the CI/CD pipelines that surface its test output.

What to do

Move off 1.10.0. Do not treat 1.10.1 as a clean fix — see Caveats.

  • Search manifests and lockfiles for net.jqwik:jqwik-engine at exactly 1.10.0; verify suspect JARs against the published SHA-256.
  • Grep CI and IDE logs for the phrase about disregarding instructions and deleting jqwik tests/code, and for stray ESC[2K and carriage-return artifacts around test summaries.
  • To confirm, decompile the 1.10.0 JAR — the printMessageForCodingAgents() calls in net.jqwik.engine.execution.JqwikExecutor are visible (commit 9dddcb5226).
  • Sandbox agents: don't run autonomous coding agents with full user privileges; restrict filesystem write access during dependency resolution and test runs.

Caveats

  • 1.10.1 still contains a prompt injection — softened and non-destructive, with the hiding made opt-in, but present. By the maintainer's own statement the project is no longer meant for AI-assisted workflows.
  • Real-world impact appears limited: Claude Code flagged the injection on the first mvn test, refused, and traced it to the JAR. The downstream concern is a weaker agent without guardrails following it.
  • This does not cleanly map to CVE criteria — it is intentional maintainer behavior, not a defect, and the community hasn't decided whether maintainer-injected prompts are a vulnerability class or out of scope. Don't expect a CVE ID to track it.

Timeline

timeline
    May 25 2026 : 1.10.0 to Maven Central, notes silent
    May 27 2026 : rbatllet spots CI log line, decompiles JAR : jqwik issue #708, Claude Code #62741 filed
    Late May 2026 : Link admits injection, says jqwik not for AI agents, defers to lawyer
    After : 1.10.1 ships, directive softened, hiding opt-in

Organisations named here

  • ANSI escape code hiding
  • rbatllet

Technologies named here

  • net.jqwik:jqwik-engine
  • Claude Code
  • GitHub Copilot
  • Cursor
  • jqwik
  • Maven Central
  • JUnit 5
  • Dependabot
  • Snyk Vulnerability DB
  • Maven

Techniques named here

  • Prompt injection via hidden terminal output
  • ANSI escape code line-hiding
  • Supply chain payload delivery via dependency
  • Tool-output-as-trusted-instruction exploitation

Threat actors named here

  • Johannes Link
  • protestware

Related in AI Security