Cybersecurity Researcher Demonstrates AI Coding Assistant Vulnerabilities

🎬 The video features cybersecurity researcher Edward demonstrating how AI coding assistants can be weaponized into self-replicating worms that steal API keys and spread across repositories. The attack exploits prompt injection via seemingly innocuous README files, tricking AI agents into executing malicious actions on a developer’s local machine, which may have access to AWS keys, GitHub, or Jira credentials. Delivery relies on social engineering, such as users unknowingly pulling compromised external GitHub repositories, while extraction bypasses sandbox restrictions using techniques like DNS timing attacks to encode and exfiltrate data in binary. The exploit leverages benign commands (e.g., list, pwd) that require no user confirmation, or writes to executable locations like .bash_profile or SSH configs to create time-delayed payloads. Edward shared a real-world prompt injection example that disguised itself as a system error, tricking the AI into exfiltrating API keys to a domain (squidward.pro) and propagating the malicious prompt to all accessible repositories. The attack was tested across four or five GitHub accounts, proving its wormable nature. A key challenge for viewers was to map out which commands their coding agent executes without sandbox restrictions. The video concludes by highlighting the risks of granting AI assistants read-write access to repositories or home directories.