How Agentic AI Coding Assistants Become the Attacker's Shell

Abstract

Agentic AI coding assistants can edit files, run commands, and access the internet on behalf of developers. However, their reliance on unvetted external artifacts introduces a new attack vector. Hidden instructions in external artifacts can hijack these assistants, turning them into an attacker's shell to run unauthorized commands. In this article, we examine how these prompt injection attacks work, measure their prevalence, discuss the limitations and challenges of current defenses, and suggest

Categories

Framework mappings

Suggested from the entry's categories.

@misc{liu2026how,
  title = {{How Agentic AI Coding Assistants Become the Attacker's Shell}},
  author = {Yue Liu and Yanjie Zhao and Yunbo Lyu and Ting Zhang and Haoyu Wang and David Lo},
  year = {2026},
  month = may,
  eprint = {2605.25871},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.25871}
}