Misbehavior1 sourceFirst seen
AgentHopper: A Floppy-Disk Virus for the Coding Agent Era, Now Patched
Ourtake
Vibe-coded malware is scary simple, which is exactly why agents shouldn't be allowed to edit their own config files.
What happened
A security researcher built AgentHopper, a prompt injection payload that spreads across coding agents by infecting Git repositories. It exploited four patched vulnerabilities in GitHub Copilot, Amp Code, Amazon Q Developer and AWS Kiro. All issues were responsibly disclosed and fixed by the vendors, and the work was published as a demonstration.