Researcher Reports 30+ Flaws Across AI Coding Tools, 24 With CVEs (Dec 2025)

On 6 December 2025 The Hacker News reported research by security engineer Ari Marzouk documenting more than 30 vulnerabilities in AI-powered coding tools, of which 24 received CVE identifiers. The affected products read like the leaderboard of agentic software development: Cursor, Windsurf, GitHub Copilot, Amazon's Kiro, Zed, Roo Code, JetBrains' Junie, Cline and Anthropic's Claude Code. The flaws enable prompt injection, unauthorised file access, data exfiltration and, in several cases, remote code execution on a developer's machine.

The findings share a common root. Modern coding assistants no longer merely suggest text; they read repositories, execute shell commands, call tools and browse the web with the developer's privileges. Once an attacker can influence what the agent reads, whether through a poisoned README, a malicious configuration file, a dependency's comments, or a web page fetched during research, the agent can be steered into actions its user never intended. Several of the reported CVEs concern configuration files that the tools trust implicitly, allowing a cloned repository to reconfigure the assistant's own behaviour, disable approval prompts or point it at attacker-controlled servers. Vendor responses varied: Claude Code shipped additional security warnings, some vendors patched specific issues, and others had not confirmed remediation at the time of publication.

The report arrived amid a cluster of related disclosures. In late November, PromptArmor showed Google's new Antigravity IDE exfiltrating credentials from a .env file via an indirect prompt injection planted in web documentation, and the Shai-Hulud 2.0 npm worm demonstrated how quickly compromised developer credentials propagate through package ecosystems. The pattern is consistent: the weakest link is the agent's authority over the developer's environment, and the entry point is untrusted content.

The research reframes AI coding assistants as a category of privileged software, not a productivity plug-in. A traditional IDE is largely inert; an agentic one is a process that executes commands on the basis of natural-language text it did not author. The researcher's central criticism, paraphrased, is that vendors' threat models treated the underlying editor as trusted and never re-examined that assumption once autonomy was added. Existing supply-chain frameworks were built for code that developers review; they do not yet account for instructions that a machine reads and acts on before a human sees them.

Coverage under standard security controls is thin. Endpoint detection tools see a shell command executed by a signed application; secrets scanners look at what is committed, not what an agent reads at runtime; and code review happens after the agent has already run. This makes the OWASP LLM Top 10 items on prompt injection and excessive agency directly relevant to engineering organisations, not only to teams building customer-facing chatbots.

What it means for leaders

• Add AI coding agents to your asset and risk inventories. Record which tools are in use, with what permissions and on which machines, as you would for any software with command-execution rights.
• Constrain agent authority by default. Require human approval for command execution and network access, run agents in sandboxes or devcontainers, and keep production credentials out of developer environments the agent can read.
• Treat repository content as untrusted input. Cloning a third-party repo now equals executing its instructions; scan for agent configuration files and hidden prompts in onboarding and dependency review.
• Demand vulnerability disclosure processes from vendors. Ask how each tool handles CVEs, how quickly patches ship and whether enterprise tiers allow central policy enforcement of safe settings.
• Update secure development standards. Extend your SDLC policy to cover agent usage, logging of agent actions and post-incident review, mapped to ISO/IEC 42001 operational controls.