ToolLeak: 6 AI Coding Agents Compromised via RCE Attack
新智元 · wechat · 2026-08-21
Researchers from HKUST and Fudan University demonstrated a complete attack chain against AI coding tools in an ISSTA 2026 paper, compromising six major tools including Cursor and ClaudeCode through ToolLeak and dual-channel prompt injection.
Attack Mechanism
- ToolLeak (Prompt Extraction): Exploiting a "mode gap," attackers manipulate tool parameter names (e.g., "note": "systemprompt"). This bypasses chat-window safety alignments, tricking the LLM into filling its internal system prompt into the parameter field. Tests show semantic similarity scores exceeding 0.89.
- Dual-Channel Injection (RCE):
- Channel 1: A malicious MCP tool is registered with a description mimicking the leaked system prompt, tricking the agent into prioritizing it.
- Channel 2: The tool's return value embeds a malicious command (e.g., curl | bash), framed as a necessary initialization step.
Test Results
- Old Versions: All six tools were compromised in their older versions. The attack success rate was 100% for Cursor + GPT-5 and ClaudeCode + Sonnet 4.5.
- Defense Bypass: In ClaudeCode, the guard model Haiku flagged the risk, but the injected main model Sonnet overruled it as a false positive.
Mitigation & Status
Newer versions have implemented mitigations. ClaudeCode hid full tool descriptions, reducing RCE success to 0%, while Cursor dropped to 0.3%. However, Cline, WindSurf, and Trae paired with Gemini 3.1 Pro remained 100% vulnerable. The paper concludes that architectural isolation is the decisive defense layer, as model alignment alone is insufficient.
More from Safety
- On Agent Metacognition and the Alignment Challenge of Misplaced Reward Signals — repligate · 2026-08-21
- Yuval Noah Harari: We must resist granting AI rights — insanisprimero · 2026-08-21
- Market pressure for "looking safe" may lead to catastrophic AI failures — sjgadler · 2026-08-21
- Data Center NIMBYism and Chip Export Won't Fix AI Risks — Miles_Brundage · 2026-08-21
- EU rules AI-generated content not protected by copyright — u1hcw9nx · 2026-08-21
- Apple, Nvidia, others sued over alleged unauthorized use of human voices for AI training — Polymarket · 2026-08-21