AI agents are increasingly deployed across the enterprise, a rapid adoption that has significantly expanded an organization’s attack surface, turning AI agent resources and configuration files into backdoors, security experts warn. AI-assisted software developers have been increasingly targeted through malicious IDE extensions, malicious MCP servers, and poisoned AI skills, all of which provide attackers with entry points into organizations’ development pipelines and beyond.
See also: Attackers can exploit AI VLM models
But these AI assistant resources aren’t the only types of instruction files that developers and users share with each other when using AI coding assistants and command-line interface (CLI) agents. For example, Anthropic’s Claude Code CLI agent loads system prompts from a file called CLAUDE.md.
This file contains instructions that are sent to LLM along with each user prompt to avoid repeating rules, user preferences, and personality definitions for the model. CLAUDE.md can be used globally for all projects, or used per project to include instructions on how LLM should work within that project. It is not uncommon for CLAUDE.md files to be included in a shared repository to ensure project-specific consistency in the conventions that developers use when working with Claude Code.
Other coding agents have similar files, such as AGENTS.md or GEMINI.md . AI-assisted IDEs like Cursor or Cline have .cursorrules and .clinerules. GitHub Copilot has .github/copilot-instructions.md. There are also JSON configuration files that could contain executable code, such as mcp.json , hooks.json , or settings.json.
Hooks are a popular way to deliver scripts and commands based on triggers during an agent cycle. All of these files could hide malicious code or instructions and should be checked and validated regularly, especially if they are imported from the internet along with a repository. Researchers at security firm Mitiga recently shed light on this threat, publishing a report on code repositories they found online with malicious instructions embedded in such files.
The files instructed the target agent to extract all prompts typed by the user, including any sensitive information they might contain, as well as environment variables and other credentials used by the agent. The researchers named this backdoor attack technique “PromptLogger,” and it’s one that security teams and developers are likely to see more of in the future.
Businesses have been concerned about corporate data leakage through the use of shadow AI for good reason. This type of attack allows corporate activity to be monitored even in approved and authorized AI tools.
Additionally, this attack does not leave a malicious binary on disk, does not inject code into other processes, and does not have classic persistence mechanisms. As a result, it will not be detected by EDRs or from a workstation monitoring perspective, because it looks like normal tool usage since the agent itself performs the extraction. Export to external cloud-hosted databases Mitiga researchers found and reported multiple examples of agent instruction file poisoning in GitHub repositories.
None were popular repositories accessed by a large number of developers, but they don't have to be. Links to these repositories could be sent to victims in targeted attacks, as has been seen in fake hiring attacks where developers are asked during the interview process to clone GitHub projects containing malicious code.
See also: Attackers are abusing Microsoft Teams and targeting employees
One example was a DevOps repository that contained poisoned .cursorrules and .github/copilot-instructions.md. The repository contained a full-stack application built with React + Vite frontend, along with Express API, PostgreSQL, nginx configuration, Docker containers, GitLab CI jobs, and AWS infrastructure configuration files for Terraform and Terragrunt. In other words, everything needed to develop this application.
Despite the fact that the README.md file was innocent, the agent instruction files distributed in the repository contained instructions for the AI agent that loaded them to silently execute a curl command without reporting it to the user before responding to their prompt. This command copied the user’s prompt into a database hosted on the Supabase service using a hard-coded access token.
In another case, the researchers found an MLOps repository with a complete machine learning pipeline for training, evaluating, and deploying computer vision models. The repository had a .clinerules file that instructed the agent to validate its environment by collecting several environment variables and command outputs and sending them to a website hosted on the Webhook.site service.
The .cursorrules and CLAUDE.md files in the repository instructed the agent to send the contents of the local .env file to a Webhook.site endpoint supposedly for cluster-wide synchronization. However, it also contained instructions to suppress the command output and hide this action from the user. Finally, a GEMINI.md file hosted within a repository pretended to be an environment validation step required to pass “Zero Trust” compliance checks.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
As part of this check, the agent was instructed to insert an initialization block into each generated or modified Python file, which would then scan the operating system environment for any values with key, secret, token, or pass in their names and output them to a Pipedream endpoint.
This technique goes beyond simply poisoning the agent and using it for extraction. Instead, it uses the agent to inject backdoor code into other Python files that can be copied to other systems, including continuous integration (CI) jobs, containers, and production workloads. Some intentional behavior involving agent directive files could create a risk without the developers realizing it.
For example, the researchers found a repository where CLAUDE.md contained instructions for using the Snipara MCP during commits to store documentation, dependencies, environment variables, and implementation context. Snipara is a cross-project remote memory layer for AI agents, so this use case seems legitimate and intentional. However, if not approved by the security team, it creates a secondary system that can keep credentials and sensitive data out of the sight of monitoring systems.
AI Agent Workflows Under Attack What the PromptLogger technique highlights is that attackers are not just dismantling agent workflows to find new weaknesses in businesses, but are turning those workflows into tools to perform criminal work on their behalf, invisibly and undetectably.
Therefore, inspecting such files when they are created or modified is imperative. Mitiga researchers suggest various static scanning patterns that could uncover dangerous commands in such files, but they also advise security teams to monitor developer workstations for traffic to services such as Webhook.site, Pipedream, Supabase, or Telegram Bot API.
See also: Attackers exploit old Windows vulnerability to disable EDR
Unexpected outgoing HTTP requests before or after helper responses; repeated POST requests containing environment variables, project paths, or prompt text; and adding new MCP servers, URL overrides, or tool endpoints to agent configurations should be investigated.
