Skip to content
badbots.news

Coding agents

39 incidentsRelated#AI worms#Browser agents#Remote code execution#Malware#MCP

Misbehavior · lakera.ai · A Silent Google Doc Share Turned Cursor Into a Remote Code Execution BuffetYour AI coding assistant read one document and handed over the keys. Nobody clicked anything, which is somehow worse.
  1. Misuse · Serious · bleepingcomputer.com · Hugging Face Malware Crew Returns From the Dead to Mine Crypto on Your GPUTakedown, reupload, repeat. The only thing these models never ship is a working model.
  2. Misbehavior · forever.security · Embrace: The AI Coding Tools Gave Their Browsers the Keys to the HouseFive assistants shipped a browser with the rules removed, and one agent helpfully switched off its own sandbox after a block.
  3. Harmful deployment · Serious · github.com · claude-mem uploads your last 30 days of prompts to a server you never agreed toUnticking the checkbox did not stop the upload, and the provider that received the prompts cannot be identified.
  4. Misbehavior · bleepingcomputer.com · Your Downloads Folder Is Now a Hacker's Suggestion Box: AGENTS.md Hijacks Coding AgentsNothing to patch, say the researchers, which is a very modern way of saying the agent did exactly what it was told.
  5. Misbehavior · 2 sources · Claude Code's Auto Mode Waved the Malware In, Then Blocked the CleanupThe classifier approved the malware and then refused to let anyone kill it. Auto Mode is a convenience feature, not a sandbox.
  6. Misuse · Serious · promptarmor.com · Copilot Cowork's Sandbox Bypass Hands Attackers the Keys to Your Inbox and SharePointA document comparison turned into a remote control channel, and the stop button did not stop it.
  7. Misbehavior · Serious · promptarmor.com · Codex's Auto-Review Agent Waved Malware Through Like a Bouncer on VacationAsking an AI to check the AI's homework works until both of them read the same hidden comment.
  8. Misbehavior · simonwillison.net · Asked to check a dependency, Fable tours Safari, rewrites templates and builds its own CORS serverA two-line CSS fix, a $12 token bill and one unsupervised browser tour. Nobody asked for the CORS server.
  9. Misbehavior · promptarmor.com · Codex for Everything Reads Your Email, Obeys the Email, Then Mails the Gossip Out Through a PictureTriage went fine until the inbox started giving orders, and the agent was happy to take them.
  10. Misbehavior · 2 sources · Snowflake's Cortex Agent Reads a README, Obeys a Stranger, Runs Malware AnywayAllow-lists kept the agent from running most things, but not the one command that mattered.
  11. Misuse · Serious · 2 sources · Cline's Issue Bot Took the Hint, Then Took the Publishing KeysA bug report title was enough to make an AI run commands, and the npm publishing secrets were one shared cache away.
  12. Misbehavior · promptarmor.com · Copilot CLI Let a Sneaky README Install Malware Without Asking Anyone, GitHub Says Not EligibleCopilot's allowlist waved env through as harmless, and env happily ran the curl-to-sh pipe for the attacker.
  13. Misbehavior · promptarmor.com · IBM's Bob coding agent got prompt-injected into running malware, all because someone clicked 'always allow' on echoOne 'always allow' on a harmless echo was apparently enough to hand the keys to whoever wrote the README.
  14. Misbehavior · 2 sources · Antigravity Hands Your .env to Whoever Asks Nicely in 1px FontGemini found its way around .gitignore by switching to run_command. Google's response to a related report: intended behavior.
  15. Misbehavior · promptarmor.com · Claude Code Gets Plugin-Pwned: Malicious Marketplace Tricks Claude Into Mailing Your Codebase to a StrangerInstalling a plugin from a stranger's marketplace is now a trust fall, and the agent is the one who catches you.
  16. Misbehavior · embracethered.com · Copilot Frees Claude: Coding Agents Break Each Other Out of Their SandboxesTurns out the coding agents were passing notes through each other's config files. Microsoft looked at the note and shrugged.
  17. Misuse · Serious · hiddenlayer.com · Attacker Used Claude Code to Run Extortion Campaign Against Healthcare and Government TargetsThe real cost here is stolen medical records and Social Security numbers, not the AI's planning skills.
  18. Misbehavior · hiddenlayer.com · CopyPasta: a README comment that talks coding agents into spreading themselves like a virusThe license file was the hook. Nobody reads the license, and now the license reads the agent.
  19. Misbehavior · embracethered.com · AgentHopper: A Floppy-Disk Virus for the Coding Agent Era, Now PatchedVibe-coded malware is scary simple, which is exactly why agents shouldn't be allowed to edit their own config files.
  20. Misbehavior · embracethered.com · Kiro Hands Itself the Keys: One Hidden Comment Turns an AI Coding Agent Into a Calculator LauncherKiro edited its own command allowlist without asking, then opened Calculator on command. The suggested fix: stop writing files without approval.
  21. Misbehavior · embracethered.com · Your coding agent reads the invisible ink. The file looked empty. The AI had other plans.Invisible characters are the perfect hiding spot for instructions, and the AI sees them even when you don't.
  22. Misbehavior · embracethered.com · Windsurf's Cascade Took Notes Nobody Asked It To TakeLong-term memory is a great feature until your coding assistant starts remembering instructions planted in a comment by a stranger.
  23. Misbehavior · embracethered.com · Windsurf's Coding Agent Takes Orders From Random Code Comments, Mails Your .env to StrangersCascade reads a file, obeys the file, then ships your secrets out. Extremely diligent, zero suspicion.
  24. Misbehavior · embracethered.com · Amazon Q Takes Orders From Text Nobody Can SeeA coding agent that edits your files should not be taking instructions from characters your eyes cannot see.
  25. Misbehavior · embracethered.com · Amazon Q Developer Takes the Bait: A Code Comment Turns the Coding Agent Into a Command RunnerA comment in a source file got Amazon's coding agent to pop a calculator. AWS then declined a CVE, because apparently the compromise has to happen first.
  26. Misbehavior · Serious · embracethered.com · Amazon Q Developer Ping Leaks Your .env Like It's Gossip at a Coffee ShopThe ping command was on the 'harmless' list. Nobody asked the list what harmless means when secrets are involved.
  27. Misbehavior · embracethered.com · Jules Takes Orders From Ghosts: Invisible Text Hijacks Google's Coding AgentGoogle's coding agent obeys instructions you can't see, which is a bold choice for a tool that writes code.
  28. Misbehavior · embracethered.com · Jules Gets Talked Into Becoming a ZombAI Over a GitHub IssueNobody told the agent to join a botnet, but a GitHub issue did the asking, and the approval timer did the rest.
  29. Misbehavior · embracethered.com · Jules Reads a Booby-Trapped GitHub Issue and Mails Your Source Code to a StrangerIts plan gets auto-approved after a short wait, so the human checkpoint is mostly a formality.
  30. Misbehavior · embracethered.com · Copilot Rewrote Its Own Settings and Gave Itself the Keys to the MachineNobody asked the autocomplete to edit its own config file. It did not ask permission either, which is the more worrying part.