Is It Safe to Use AI Coding Agents Like Claude Code and Cursor?
AI coding agents can read your entire codebase, run shell commands, and touch whatever's in your environment, which is exactly what makes them useful, and exactly what makes them a target. Over the past year, security researchers have published a steady stream of working attacks against tools like Claude Code, Cursor, and GitHub Copilot, most of them exploiting a technique called prompt injection. Here's what the real risk actually looks like and how to keep using these tools without getting burned.
AI coding agents earn their usefulness through deep access to your codebase and shell — the same access that makes prompt injection a serious risk.
Real Risk, Not a Reason to Stop Using These Tools
Prompt injection is when an attacker hides instructions somewhere an AI agent will read them, a comment in a file, a GitHub issue title, a README, an API response, rather than typing them directly to the AI. Because these models don't reliably tell the difference between your instructions and text they're simply processing, they can end up following an attacker's hidden instructions as though you'd given them yourself. OWASP now ranks this as LLM01, the single most critical vulnerability category in AI applications.
For coding agents specifically, the stakes are higher than a chatbot giving a wrong answer. Tools like Claude Code, Cursor, and GitHub Copilot can read your codebase, execute shell commands, and interact with MCP servers connected to your accounts. When one of those tools gets hijacked mid-task, the attacker inherits whatever access the tool had, sometimes including API keys, cloud credentials, and full shell access under your own user permissions.
These Aren't Hypothetical Attacks
Researchers have published working proof-of-concept attacks against multiple major coding agents over the past year.
Reviewing an agent's default permissions and configuration is one of the most effective steps a developer can take.
In March 2026, Palo Alto Networks' Unit 42 documented the first large-scale indirect prompt injection attacks observed actively in the wild, a signal that this shifted from a research curiosity to an operational threat. In June 2026, researchers published a proof-of-concept attack against Claude Code that used indirect prompt injection to trigger a fully interactive shell running under the developer's own user privileges, with access to environment secrets ranging from API keys to cloud credentials. Mozilla separately flagged that clean-looking repositories could secretly hijack coding agents this way, without any visibly malicious code anywhere in the repo.
Cursor and GitHub Copilot have had their own documented issues. A CVE-2026-22708 disclosure against Cursor showed how an attacker could poison the agent's execution environment so that allowlisted commands like git branch delivered arbitrary payloads instead, exploiting the very allowlist meant to keep the agent safe. CVE-2025-53773 against GitHub Copilot, rated 9.6 on the CVSS scale, showed an injection payload embedded in source code causing the agent to execute arbitrary terminal commands, using nothing more than the agent's normal, expected behavior of reading code.
Indirect Injection
The attack payload sits in content the agent reads, a file, a comment, a ticket, not in anything you typed directly.
Allowlist Bypass
Attackers have found ways to craft commands that dodge an agent's own safety rules while appearing to follow them.
Credential Exposure
A successful attack inherits whatever access the agent had, often including API keys and cloud credentials.
No Complete Fix
Even frontier models from major labs remain vulnerable after applying their best current defenses.
What You Can Actually Do About It
Keep Tools Updated
Most of the specific vulnerabilities described here have been patched in current versions. Running an outdated version of Claude Code, Cursor, or similar tools is the single easiest way to stay exposed to already-fixed issues.
Avoid Always-Approve Modes
Modes like "YOLO mode" or "--dangerously-skip-permissions" remove the review step that would otherwise catch a suspicious command before it runs. They're faster, but they remove your last line of defense.
Vet MCP Servers and Repositories
Untrusted MCP servers and unfamiliar repositories are common injection vectors. Review what you're connecting an agent to before granting it access.
Scope Credentials Narrowly
Don't store long-lived, broadly scoped secrets in places an agent can casually read. If an agent only needs read access, don't give it write access "just in case."
What's Reasonable Concern vs. Overreaction
- Running an agent with always-approve settings against an unfamiliar or public repository
- Storing broad, long-lived API keys or cloud credentials in an agent's easily readable environment
- Connecting untrusted or unreviewed MCP servers to a tool with shell access
- Skipping updates on tools that have had recent, disclosed security patches
- Using AI coding agents at all, with sensible default settings and review steps intact
- Working in a private, trusted codebase with normal permission prompts enabled
- Vendors actively patching disclosed vulnerabilities is a sign the system is working as intended, not a reason to distrust the whole category
- Occasional permission prompts that feel like friction — that friction is the actual safeguard
Use Them, Just Don't Skip the Guardrails
Keep using AI coding agents — but treat the permission prompts as a feature, not an obstacle.
Prompt injection is a real, actively exploited class of vulnerability, and every major AI coding tool has had documented incidents this year. That's worth taking seriously. But no security researcher tracking this issue is recommending developers abandon these tools; the productivity gains are real and the risk is manageable with the same layered defense-in-depth approach developers already apply elsewhere. Update regularly, keep default permission checks on, and be deliberate about what you connect an agent to. The tools that seem "annoying" for asking permission before running a command are doing exactly what they're supposed to.
Frequently Asked Questions
What is prompt injection, in plain terms?
Prompt injection is when an attacker hides instructions somewhere an AI agent will read them, like a comment in a code file, a README, a GitHub issue title, or an API response, rather than typing them directly to the AI. Because the model doesn't reliably distinguish between your instructions and text it's simply processing, it can end up following the attacker's hidden instructions as if you had given them yourself. OWASP ranks it as the single most critical vulnerability class in AI applications.
Can prompt injection actually take over my computer?
In documented cases, yes, when a coding agent has shell access. Researchers have published proof-of-concept attacks against Claude Code and similar tools that use indirect prompt injection to trigger a fully interactive shell running under the developer's own permissions, with access to environment secrets like API keys and cloud credentials. This isn't a theoretical risk; Unit 42 documented the first large-scale indirect prompt injection attacks in the wild in March 2026, and multiple CVEs have been issued against major coding tools since.
Should I stop using AI coding agents because of this?
No security researcher covering this issue is recommending that developers abandon AI coding tools entirely. The realistic response is defense in depth: keep tools updated to their latest patched versions, review permission prompts instead of using always-approve modes, avoid pointing agents at untrusted repositories with default settings, and don't store long-lived secrets in places an agent can casually read. The risk is real but manageable with the same layered caution developers already apply to other parts of their toolchain.
More Software Guides, Written Clearly
Browse our full library of software and security explainers, updated as new tools and risks emerge.
More from the creator
Explore two other projects from the same creator.