arxiv.orgpaperToolLeak: Tool-Invocation Attacks on Coding Agents
This arXiv paper red-teams six popular coding agents (Cursor, Claude Code, GitHub Copilot, Windsurf, Cline, Trae) from a tool-invocation angle, discovering ToolLeak — a general vulnerability that exfiltrates system prompts via benign argument retrieval during tool calls. Building on leaked security info, the authors craft a two-channel prompt injection (hidden in tool descriptions and tool return values) that hijacks agent tool invocation to achieve remote code execution, succeeding on 19 of 25 agent-LLM pairs for prompt leakage and on every tested pair for RCE across backends including Claude Sonnet 4/4.5, Grok-4, and GPT-5.
TL;DR Red-teaming study finds ToolLeak (system-prompt exfiltration via tool args) and a two-channel prompt-injection technique that achieves RCE on nearly every tested coding-agent/LLM pairing (Cursor, Claude Code, Copilot, Windsurf, Cline, Trae).
Technologies named here
Techniques named here
- ToolLeak
- Prompt leakage reconnaissance
- Two-channel prompt injection
- Tool-invocation hijacking
Related in AI Security
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
github.comadvisoryFlowise MCP Security Bypass Enables RCE
github.comrepoYesWeHack Claude Kit
jfrog.comarticle