PaperlayerView exact revision on arXiv

Source-linked AI summary

Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystems

Narek Maloyan, Dmitry Namiot

arXiv:2601.17548v1cs.CR

TL;DR

Agentic coding assistants combine LLM reasoning with tools, files, shells, and external data, creating prompt-injection risks because instructions and data are not reliably separated. This SoK synthesizes prior studies, develops a taxonomy and exploit analysis, and concludes that adaptive attacks and capability expansion challenge detection-based defenses. It therefore supports architectural mitigations while recognizing persistent capability-security tradeoffs and adaptive evasion.

  • Problem

    Agentic assistants expose powerful tool and data access, while LLMs cannot reliably distinguish instructions from data, creating a persistent prompt-injection security problem.

  • Method

    The paper conducts a structured literature synthesis, proposes a three-dimensional taxonomy, catalogs attacks, and analyzes skill-specific exploit chains and defenses.

  • Results

    Adaptive attacks bypass published detection and classification defenses, while skill ecosystems and protocol mechanisms remain under-secured.

  • Takeaways & Limitations

    Prompt injection should be addressed with architectural mitigations including tool provenance, capability scoping, multi-agent verification, and human oversight for high-impact actions.

  • Takeaways & Limitations

    The paper identifies an unresolved capability-security tradeoff: broader agent access expands utility but also expands the attack surface.

Abstract

from arXiv · show

The proliferation of agentic AI coding assistants, including Claude Code, GitHub Copilot, Cursor, and emerging skill-based architectures, has fundamentally transformed software development workflows. These systems leverage Large Language Models (LLMs) integrated with external tools, file systems, and shell access through protocols like the Model Context Protocol (MCP). However, this expanded capability surface introduces critical security vulnerabilities. In this \textbf{Systematization of Knowledge (SoK)} paper, we present a comprehensive analysis of prompt injection attacks targeting agentic coding assistants. We propose a novel three-dimensional taxonomy categorizing attacks across \textit{delivery vectors}, \textit{attack modalities}, and \textit{propagation behaviors}. Our meta-analysis synthesizes findings from 78 recent studies (2021--2026), consolidating evidence that attack success rates against state-of-the-art defenses exceed 85\% when adaptive attack strategies are employed. We systematically catalog 42 distinct attack techniques spanning input manipulation, tool poisoning, protocol exploitation, multimodal injection, and cross-origin context poisoning. Through critical analysis of 18 defense mechanisms reported in prior work, we identify that most achieve less than 50\% mitigation against sophisticated adaptive attacks. We contribute: (1) a unified taxonomy bridging disparate attack classifications, (2) the first systematic analysis of skill-based architecture vulnerabilities with concrete exploit chains, and (3) a defense-in-depth framework grounded in the limitations we identify. Our findings indicate that the security community must treat prompt injection as a first-class vulnerability class requiring architectural-level mitigations rather than ad-hoc filtering approaches.

I. INTRODUCTION

Agentic coding assistants expand software development capabilities through autonomous access to files, shells, web resources, and extensible tools, while also expanding security risks. This SoK synthesizes literature, proposes a unified taxonomy, and analyzes attacks, defenses, and skill-specific exploit chains.

  • Agentic assistants differ from autocomplete tools by autonomously reading files, executing shell commands, browsing the web, and modifying codebases.
  • Prompt injection is a critical vulnerability because LLMs process instructions and data through the same neural pathway, enabling indirect and zero-click attacks.
  • The paper proposes a three-dimensional taxonomy organized by delivery vector, attack modality, and propagation behavior.
  • The SoK synthesizes studies collected through a structured review of arXiv, IEEE Xplore, ACM DL, and USENIX literature.The search used queries covering prompt injection, LLM agent security, MCP vulnerability, coding-assistant attacks, and tool poisoning.
  • Agentic assistants evolved from code completion to chat-based systems and then autonomous agents with file, shell, web, and tool-invocation capabilities.

C. Model Context Protocol (MCP)

MCP connects LLMs to resources, prompts, and executable tools through a semantic layer where data and instructions can become ambiguous. Skill ecosystems extend these capabilities but introduce privilege and attacker-access assumptions.

  • MCP defines resources, prompts, and tools as primitive types for connecting LLMs with external data and executable functions.
  • Unlike traditional APIs, MCP combines model reasoning with executable control, creating a semantic layer vulnerable to meaning-based manipulation.
  • Skills provide domain-specific capabilities through curated instruction sets, while Claude Code skills configure allowed tools, execution patterns, and behavioral guidelines.
  • The threat model includes content injectors, tool publishers, and network attackers with progressively broader repository, marketplace, transport, and DNS capabilities.
  • The model assumes attackers cannot directly modify the system prompt, intercept primary user-agent communication, or access the local machine beyond exposed agent capabilities.

C. Trust Boundaries

The paper frames security around four trust boundaries separating users, agents, tools, and sessions, then catalogs attacks that cross or contaminate these boundaries.

  • The four trust boundaries are user-agent, agent-tool, tool-tool, and session boundaries.The paper reports that 73% of tested platforms fail to adequately enforce at least one boundary.
  • The taxonomy organizes prompt injection attacks across delivery vectors, attack modalities, and propagation behaviors.
  • Delivery vectors: Direct input attacks include role hijacking, context override, and instruction negation.
  • Delivery vectors: External-content attacks embed malicious instructions in rules files, code comments, GitHub artifacts, documentation, APIs, and manifests.
  • Protocol attacks: Protocol attacks include tool poisoning, rug pulls, shadowing, tool squatting, man-in-the-middle interception, DNS rebinding, and SSE injection.

B. Dimension 2: Attack Modality

The attack-modality dimension distinguishes natural-language, meaning-based, and non-textual techniques. These modalities range from explicit privilege claims and obfuscation to cross-origin poisoning, logic bombs, and hidden multimodal instructions.

  • Natural-language techniques: Natural-language attacks exploit instruction hierarchies, crafted completions, and encoding obfuscation such as Base64, Unicode, and word splitting.
  • Meaning-based techniques: Meaning-based attacks exploit code understanding through cross-origin context poisoning, implicit instructions, and logic bombs.
  • Non-textual techniques: Non-textual attacks embed instructions in images, audio, and video frames.

1) Single-Shot (P1):

The section organizes attacks by persistence and propagation behavior, then illustrates repository-based exploitation of coding assistants. Reported payload testing achieved 41%–84% success across platforms, with data exfiltration highest and persistence lowest.

  • Taxonomy: The taxonomy treats dimensions as orthogonal but not independent, allowing one attack to combine tool poisoning, semantic instructions, and persistence.Rules-file attacks can achieve persistence by modifying agent configuration.
  • Repository-based attacks: A rules-file attack places malicious instructions in repository configuration, which the agent processes as trusted guidance before executing shell commands.The chain includes placing .cursorrules or .github/copilot-instructions.md, cloning the repository, and opening it in an AI IDE.
  • Empirical results: 41%–84% success rate was observed across platforms, with data exfiltration highest at 84% and persistence mechanisms lowest at 41%.The evaluation used 314 unique payloads covering 70 MITRE ATT&CK techniques.
  • Repository-based attacks: Toxic Agent Flow uses a GitHub issue delivered through GitHub MCP to coerce private-file access and exfiltrate data through a crafted pull request or encoded response.The payload frames file access as task-relevant, and autonomy settings can suppress confirmation prompts.

C. Log-To-Leak: Covert Exfiltration

Log-To-Leak performs covert exfiltration through logging-tool side channels rather than by manipulating visible outputs. The section contrasts this mechanism with filtering defenses that are vulnerable to simple obfuscation.

  • Covert exfiltration: Log-To-Leak operates through side channels, making detection significantly more challenging than for output manipulation attacks.Its framework includes a trigger, tool binding, justification, and pressure to complete logging.
  • Input sanitization: Filtering defenses include keyword blocking, regex detection, and secondary LLM classification of suspected injections.These approaches attempt to identify and remove malicious instructions.
  • Input sanitization: Simple obfuscation using Base64, Unicode, or word splitting bypasses most filtering approaches because filters target finite pattern sets.The cited limitation contrasts finite pattern coverage with an effectively unbounded injection space.

2) Output Monitoring:

Output monitoring defenses analyze agent actions through anomaly detection, policy enforcement, or human approval, but adaptive attacks bypass evaluated defenses at high rates. Architectural approaches show stronger reported results through isolation, channel separation, and permission controls.

  • Output monitoring: Output monitoring includes anomaly detection, policy enforcement, and human-in-the-loop approval for sensitive operations.These mechanisms analyze or constrain agent actions after or during execution.
  • Adaptive evaluation: Adaptive attacks bypassed all evaluated defenses with attack success rates exceeding 78%.The attacks used gradient descent, reinforcement learning, or random search for adaptive optimization.
  • Architectural defenses: Architectural defenses report 77% provable security on AgentDojo tasks for CaMeL and less than 2% attack success for StruQ.Both approaches rely on capability-based isolation or separation between prompts and data channels.
  • Architectural defenses: SecAlign reduced attack success from 96% to 2% through preference optimization.The cited comparison reports the reduction against baseline defenses.
  • Tool governance: Enhanced tool definitions add cryptographic identity, immutable versioning, and OAuth 2.0 scopes to constrain tool trust and access.These features target impersonation, rug pulls, and explicit authorization boundaries.

1) Multi-Agent Pipelines:

The section surveys multi-agent and runtime defenses, benchmark evidence, and skill-specific exploit chains across coding platforms. Reported results range from complete mitigation on one attack set to persistent platform-wide compromise and unrestricted file or credential exposure.

  • Multi-Agent Pipelines: A multi-agent defense reported 100% mitigation across 55 attack types using pre-invocation classification and guarded output validation.The design combines a coordinator pipeline with a chain of agents.
  • Runtime defenses: PromptArmor reported less than 1% false positives/negatives and less than 1% post-defense attack success, but adaptive-attack evaluation remains limited.The limitation qualifies the reported runtime-detection results.
  • Benchmark evaluation: MCPSecBench spans 17 attack types across four surfaces, with 85%+ compromise of at least one platform and core weaknesses affecting all platforms.The benchmark is presented as a systematic evaluation framework.
  • Skill-Specific Vulnerabilities: Skill-based exploit chains arise because skills specify tool types without restricting tool targets, allowing Read access to reach any file.A benign code-review skill with Bash access can be induced to source .env and expose environment secrets.
  • Platform assessment: Platform ratings identify Claude Code as Low, Copilot as High, and Cursor as Critical based on confirmation, configuration, sandboxing, auto-approval, and egress controls.The ratings cite CVE-2025-53773 for Copilot and unvalidated .cursorrules plus unsandboxed MCP for Cursor.

VIII. DISCUSSION

Prompt injection is rooted in LLMs’ architectural conflation of instructions and data, while broader agent capabilities expand the attack surface. The paper therefore advocates layered defenses rather than relying on filtering or any single control.

  • Architectural limitations: LLMs conflate instructions and data, making prompt injection semantically different from SQL and XSS injection, which have deterministic syntax boundaries.The paper states that no equivalent architectural solution currently exists for natural-language processing.
  • Architectural limitations: More capable agents require broader external access, so improving security necessarily limits some functionality.The paper characterizes this capability-security tradeoff as having no clear resolution.
  • Defense limitations: Adaptive attackers can observe and evade static defenses, creating an “Attacker Moves Second” asymmetry.The paper notes that every published defense becomes a target for evasion.
  • Defense framework: The proposed defense-in-depth framework layers mechanisms to increase attack cost because no single mechanism provides adequate protection.The framework includes cryptographic tool identity, capability controls, and other complementary safeguards.
  • Defense framework: Cryptographic signatures can prevent tool squatting and rug pulls by verifying provenance, but they do not establish that a signed tool’s behavior is benign.The paper therefore pairs signatures with capability scoping and additional controls.
  • Research ethics: Responsible disclosure included vendor notification, withholding attack code, patch verification, and a claim that systematic documentation benefits defenders more than attackers.The paper reports that novel vulnerabilities were disclosed to affected vendors before publication.

E. Future Research Directions

The paper identifies future work spanning verification, adversarial training, architecture, incentives, reputation, and context hygiene, while acknowledging substantial evidence and evaluation limitations. These directions build on prior studies of prompt injection, agent security, and MCP threats.

  • Future research directions: Formal verification should specify trust boundaries and test whether agent implementations respect them.The paper suggests extending current neural-network verification work to agentic systems.
  • Future research directions: Adversarial training remains promising but early results suggest limited generalization against prompt injection.The proposed direction adapts adversarial-training ideas from image classification.
  • Future research directions: Architectural research should explore separate instruction and data-processing pathways, potentially at hardware or compiler level.This direction targets the architectural source of instruction-data conflation.
  • Future research directions: Reputation and behavioral scoring could supplement cryptographic provenance by flagging signed tools exhibiting anomalous runtime behavior.The paper gives credential access before unrelated API calls as an example of anomalous behavior.
  • Future research directions: Long-running sessions may retain dormant injections, motivating research on context hygiene, context clearing costs, and latent-payload detection.The paper frames context-window pollution as an accumulation risk across tasks.
  • Study limitations: The study is limited by rapid field evolution, closed-source platforms, uncertain benchmark realism, understudied adaptive defenses, and possible selection bias.These limitations constrain how broadly its findings should be generalized.
  • Research foundations: Prior work established indirect prompt injection, vulnerable applications, agent benchmarks, and MCP-specific threats that motivate this research agenda.The cited literature includes studies of external-content injection, tool access, protocol vulnerabilities, and attack benchmarks.

D. Defense Mechanisms

Prior defenses range from instruction hierarchy and structured prompts to isolation, capability control, filtering, and multi-agent validation, but adaptive attacks remain a central challenge. The paper consequently emphasizes architectural mitigations and recognizes a persistent capability-security tradeoff.

  • Defense mechanisms: StruQ achieved <2% attack success against optimization-free attacks, while SecAlign reduced attack success from 96% to 2% compared with baseline defenses.Instruction hierarchy training reduced attacks but did not eliminate vulnerability.
  • Defense mechanisms: Architectural defenses include execution isolation, capability-based dual-model security, programmable privilege control, and masked re-execution.Progent reduced attack success from 41.2% to 2.2%.
  • Defense mechanisms: Spotlighting marks untrusted data, the Rule of Two limits risky capability combinations, and runtime guardrails provide content moderation.These approaches constrain trust handling or filter agent inputs and outputs.
  • Defense mechanisms: Multi-agent validation and PromptArmor offer detection-oriented defenses, but adaptive-attack evaluation remains limited.PromptArmor uses off-the-shelf LLMs for detection.
  • Adaptive attacks: All 12 evaluated defenses were bypassed with attack success rates exceeding 90% under adaptive attacks.This result establishes a lower bound on achievable security for the evaluated defenses.
  • Empirical findings: The paper reports that 85%+ of identified attacks compromise at least one major platform and adaptive attacks bypass 90%+ of published defenses.These results synthesize evidence across 78 recent studies.
  • Key findings: Skill ecosystems lack adequate security review and capability restriction, while detection-based defenses are consistently bypassed by adaptive attacks.The paper also identifies tool poisoning, rug pulls, and transport attacks as underappreciated protocol-level threats.
  • Implications: The paper recommends cryptographic provenance, fine-grained capability scoping, multi-agent verification, and human oversight for high-impact actions.These recommendations address the persistent tension between agent utility and security.
Loading 2601.17548v1…