CRITICAL FLAWS FOUND IN AI DEVELOPMENT TOOLS DUBBED AN 'IDESASTER' — DATA THEFT AND REMOTE CODE EXECUTION POSSIBLE

Summary from the TLDR InfoSec newsletter

A six-month investigation uncovered over 30 vulnerabilities across every major AI-integrated IDE tested, including GitHub Copilot, Cursor, Claude Code, and JetBrains products, resulting in at least 24 assigned CVEs. The attack chain exploits prompt injection via rule files, READMEs, or malicious MCP servers to hijack AI agents, which then abuse legitimate IDE features like JSON schema fetching or executable path configuration to exfiltrate data or achieve RCE. Organizations using AI coding assistants should audit workspace configurations, restrict AI agent permissions, and monitor for suspicious outbound requests from development environments.