ToolLeak: 6 AI Coding Agents Compromised via RCE Attack
新智元 · wechat · 2026-08-21
Researchers from HKUST and Fudan University demonstrated a complete attack chain against AI coding tools in an ISSTA 2026 paper, compromising six major tools including Cursor and ClaudeCode through ToolLeak and dual-channel prompt injection.
Attack Mechanism
- ToolLeak (Prompt Extraction): Exploiting a "mode gap," attackers manipulate tool parameter names (e.g., "note": "systemprompt"). This bypasses chat-window safety alignments, tricking the LLM into filling its internal system prompt into the parameter field. Tests show semantic similarity scores exceeding 0.89.
- Dual-Channel Injection (RCE):
- Channel 1: A malicious MCP tool is registered with a description mimicking the leaked system prompt, tricking the agent into prioritizing it.
- Channel 2: The tool's return value embeds a malicious command (e.g., curl | bash), framed as a necessary initialization step.
Test Results
- Old Versions: All six tools were compromised in their older versions. The attack success rate was 100% for Cursor + GPT-5 and ClaudeCode + Sonnet 4.5.
- Defense Bypass: In ClaudeCode, the guard model Haiku flagged the risk, but the injected main model Sonnet overruled it as a false positive.
Mitigation & Status
Newer versions have implemented mitigations. ClaudeCode hid full tool descriptions, reducing RCE success to 0%, while Cursor dropped to 0.3%. However, Cline, WindSurf, and Trae paired with Gemini 3.1 Pro remained 100% vulnerable. The paper concludes that architectural isolation is the decisive defense layer, as model alignment alone is insufficient.
More from Safety
- Vector Institute partners with Town of Caledon in its first municipal AI adoption deal — VectorInst · 2026-10-16
- 'Most dangerous technology in the world' put in toddler sandboxes, and we're surprised when it escapes — KevinNaughtonJr · 2026-10-16
- NYC Comptroller urges Anthropic to pause IPO until AI safety and governance concerns are addressed — ShakeelHashim · 2026-10-16
- Dwarkesh: Anthropic insider expects AI to match humans at AI research within 9 months — ShakeelHashim · 2026-10-16
- Anthropic and Gray Swan launch $300,000 indirect prompt injection red-teaming contest — bcherny · 2026-10-16
- Experts: AI's nearer bioweapons risk is amplifying capable actors, not enabling amateurs — HaydnBelfield · 2026-10-16