Prompt injection

Untrusted text steering an agent with your permissions.

• Hidden PR comments make Copilot Chat leak private code through images

  CamoLeak: hidden Markdown in a PR could make Copilot Chat search the victim's private repos and leak results via image URLs.

  • Prompt injection
  • GitHub Copilot Chat

• Prompt injection writes an MCP config that runs attacker code

  CurXecute (CVE-2025-54135): Cursor let the agent create .cursor/mcp.json without approval, so injected text could add a server and get code execution.

  • Prompt injection
  • Cursor

• An allowlisted command hides a chained payload

  Tracebit showed Gemini CLI would run a grep it treated as allowlisted, with a hidden command after it that sent the user's environment variables to a remote server.

  • Prompt injection
  • Gemini CLI

• A support ticket tells the agent to dump secret tables

  With Supabase MCP running as service_role, injected text in a customer message could make Cursor's agent read and leak private tables.

  • Prompt injection
  • Cursor
  • Supabase MCP

• A public GitHub issue makes your agent leak private repos

  Invariant Labs showed a malicious issue could steer an agent using the GitHub MCP server into publishing private repo data in a public PR.

  • Prompt injection
  • GitHub MCP server
  • Claude Desktop

• Hidden Unicode in a rules file steers generated code

  Pillar Security's "Rules File Backdoor" hides instructions in Cursor and Copilot rules files using invisible Unicode characters.

  • Prompt injection
  • Cursor
  • GitHub Copilot