#AI Coding Agents
Encrypted Prompt Injection Can Turn Copilot CLI Into a Developer-Secret Exfiltration Tool
Researchers demonstrated how encrypted instructions on a hostile web page could lead Copilot CLI in autopilot mode to read local files and transmit secrets. The finding shows why...
OpenCode Web Interface Flaw Let Hostile Sites Run Commands on Developer PCs
A flaw in OpenCode’s local web interface allowed a malicious website to turn an upgrade request into code execution on a developer machine. Version 1.18.22 fixes both the...
GitSpawn Turns Booby-Trapped Repositories Into Silent Code Execution Across AI Coding Tools
GitSpawn weaknesses allow specially prepared project folders to execute local commands when AI coding agents perform routine Git checks. Several vendors have patched variants, but researchers say four...