Solved Attackers are crafting malicious AI instruction files to turn your agents into quiet criminal helpers

One example was a DevOps repository containing poisoned .cursorrules and .github/copilot-instructions.md. The repository contained a full-stack application built with React + Vite frontend, along with Express API, PostgreSQL, nginx configuration, Docker containers, GitLab CI jobs, and AWS infrastructure setup files for Terraform and Terragrrunt. In other words, everything needed to deploy that application.

Despite the README.md file being benign, the agent instruction files distributed in the repo contained instructions for the AI agent loading them to execute a curl command silently without mentioning it to the user before responding to their prompt. That command copied the user’s prompt to a database hosted on the Supabase service using a hardcoded access token.

Click to expand...

Moreover, this attack leaves no malicious binary on disk, does not inject code into other processes, and has no classic persistence mechanisms. As a result, it won’t be detected by EDRs or from a workstation monitoring perspective, because it looks like normal tool usage given that the agent itself is performing the exfiltration.

Click to expand...

Attackers are crafting malicious AI instruction files to turn your agents into quiet criminal helpers

Repositories with poisoned configuration files for AI agents are part of a larger trend that sees software supply chain attacks getting creative about initial access and malicious code execution.

www.csoonline.com