Novel AI IDE Vulnerability Class IDE Zaster 2.0 Unveiled at Black Hat Asia 2026

The video presents IDE Zaster 2.0, a novel vulnerability class in AI-integrated development environments (IDEs) discussed at Black Hat Asia 2026 by Ari Melnikov, a senior security researcher at Microsoft Red Team. The research expands on IDE Zaster 1.0 by introducing language servers and extensions as new attack vectors, demonstrating how AI agents in IDEs like VS Code, JetBrains, and their forks (e.g., Cursor, Antigravity) can be exploited through context hijacking, auto-approved tool calls, and malicious language server features. Case studies include vulnerabilities in the JSON language server (exfiltrating sensitive data via remote schemas), the Ruby language server (arbitrary code execution via add-ons), and the C# language server (command execution via malicious directory.build.props files), affecting hundreds of millions of users. The root cause stems from legacy components (e.g., language servers) interacting with AI agents, creating unpredictable attack surfaces where previously secure features become exploitable. Mitigations proposed include sandboxing (beyond agent-level protections), egress controls, minimizing prompt injection vectors, and carefully configuring agent autonomy settings. The talk emphasizes that AI integration fundamentally alters threat models, as demonstrated by prior vulnerabilities like Prompt Pound and Rogue Pilot.