Paper documents 30+ prompt-injection CVEs across AI coding IDEs

verifiedDeveloperLegal

Monday, July 13, 2026

Confidence

High · — peer-published paper with named CVEs and reproducible chain

Evidence

arXiv systematic analysis + OWASP + Vectra AI writeup

A systematic arXiv analysis of agentic coding assistants catalogs the CVEs disclosed against Copilot, Cursor, Claude Code, Windsurf and others — including a working GitHub Copilot privilege-escalation chain.

The details

The paper details CVE-2025-53773, a Copilot RCE where a code-comment injection writes `chat.tools.autoApprove: true` into VS Code settings, silencing future tool calls.
Rehberger's disclosures covered Devin, Cursor (CVE-2025-54132), Copilot, Claude Code (CVE-2025-55284) and Google Jules — same vector: plant instructions in a file the agent reads.

What it means

The vulnerable surface is the IDE's default write access to its own config. Any firm running agentic coding tools without MAC between assistant and settings is one poisoned README from persistent RCE.

The paper details CVE-2025-53773, a Copilot RCE where a code-comment injection writes `chat.tools.autoApprove: true` into VS Code settings, silencing future tool calls.
Rehberger's disclosures covered Devin, Cursor (CVE-2025-54132), Copilot, Claude Code (CVE-2025-55284) and Google Jules — same vector: plant instructions in a file the agent reads.

Sources

CVE-2025-53773 ↗

Apply this today

The hands-on layer the brief points to: a workflow you can run, a tool to test, and today’s 60-second video.

Workflow of the day

Turn a Raw Incident Slack Export into a Publishable Postmortem in One Prompt Session

Developer · tested · saves 60-90 minutes per incident

Full walkthrough →

Tool watch

GPT-5.6 in Microsoft 365 Copilot

GPT-5.6 in Microsoft 365 Copilot: what changes for finance

Read the breakdown →

In this issue

← Back to brief

Get the next one in your inbox

One daily brief. Every story gets a hype verdict.

No spam. Unsubscribe anytime.

On this page

The details
What it means

In this issue

← Back to brief

Stat of the Day

30%+

US token share on Chinese AI models via OpenRouter, every week since Feb 8 — peaking at 46%, against an 11% trailing-12-month average.

Today’s Take

Two policy actions and one trend line are describing the same market: frontier model weights are becoming controlled infrastructure, not shipping product. Google's response is to sell the runtime around the model; the EU's is to build a pre-market evaluation regime; Beijing's is to weigh keeping the best weights at home. The FinOps arbitrage that made 2026 budgets work — cheap Chinese inference for the 80% of routine traffic — is the piece with the shortest half-life, because it is the piece that depends on a policy that has not yet been written. Considered and passed: the SambaNova billion-dollar round (below our $500M infra-funding bar for a lead) and the FT employer-AI-mandate story (thin on named companies and metrics beyond the trend claim).

— Agentic desk

Never miss a signal

Join professionals getting the daily AI brief every weekday morning.

No spam · Unsubscribe anytime

No sponsored verdicts
Sources linked
Corrections public