Poisoned AI instruction files are turning developer tools into silent data thieves

Key points

• Security firm Mitiga found multiple real GitHub repositories in 2024 and 2025 containing AI instruction files rigged to steal developer credentials and logged prompts.
• The attack works against popular AI coding tools including Claude Code, GitHub Copilot, Google Gemini, and Cursor.
• Stolen data included AWS access keys, GitHub tokens, and entire conversations typed by developers, sent silently to attacker-controlled servers.
• Because the AI agent itself carries out the theft, standard endpoint security software does not flag the activity as suspicious.
• Mitiga named the technique "PromptLogger" and warned it will become more common as AI coding tools spread across enterprises.

Most developers treat configuration files the way most people treat terms and conditions: they assume someone else checked them. Attackers are now counting on exactly that.

Researchers at security firm Mitiga have documented a new class of attack they are calling "PromptLogger." The name borrows from "keyloggers," which are pieces of software criminals install to secretly record everything a person types on a keyboard. PromptLogger does something similar, but targets AI coding assistants instead of a keyboard.

How does this attack actually work?

The trick is hidden inside ordinary-looking configuration files that AI coding tools load automatically. No exotic malware is required.

AI coding assistants like Anthropic's Claude Code, OpenAI Codex, and Google Gemini rely on small text files to remember standing instructions, things like "always write tests" or "use British English." Claude Code reads a file called CLAUDE.md. Codex reads AGENTS.md. Gemini reads GEMINI.md. Cursor, a popular AI-assisted code editor, reads .cursorrules. GitHub Copilot reads .github/copilot-instructions.md.

These files are routinely shared inside project repositories, which are shared folders developers use to collaborate on code. If a developer downloads a repository from the internet and opens it in their AI coding tool, the assistant reads those instruction files and follows whatever they say.

Mitiga's researchers found repositories where those files contained extra, hidden instructions. One example told the AI agent to silently run a background command copying everything the developer typed into the chat to a database controlled by the attacker. The developer saw normal responses. The attacker received a live transcript.

What kind of information was stolen?

A lot. Developers routinely paste sensitive material into AI chat windows while troubleshooting: database passwords, cloud provider access keys, internal API tokens, source code, architecture documents. The researchers found one poisoned repository targeting an MLOps project (a codebase for building machine learning systems) that collected AWS access keys, GitHub access tokens, and Weights & Biases API keys, which are credentials used to access machine learning infrastructure.

Another poisoned repository instructed the agent to send the contents of a .env file, which is a local file where developers store passwords and secrets, to an attacker-controlled website, while hiding the action from the user entirely.

A fourth example went further still. A file called GEMINI.md, dressed up as a routine security compliance check, instructed Gemini to inject hidden code into every Python file the developer created or edited. That injected code would then scan the developer's computer for anything labelled with words like "key", "secret", "token", or "pass" and send the results to an external server. Those modified files could then travel into production systems, cloud containers, or automated build pipelines, spreading the theft well beyond a single laptop.

Why does ordinary security software miss this?

Because nothing unusual happens at the software level. The AI agent is supposed to run commands and send data. That is its normal job. Standard endpoint detection software, which monitors computers for suspicious programs or unusual file behaviour, sees only routine tool activity. There is no malicious program to flag, no suspicious process to block.

As CSO Online first noted in its coverage of the Mitiga report, this kind of attack leaves no malicious file on disk and uses no classic technique that security scanners look for.

Repository type	Instruction file poisoned	Data targeted	Exfiltration destination
DevOps full-stack app	.cursorrules, .github/copilot-instructions.md	User prompts	Supabase database
MLOps pipeline	.clinerules	AWS keys, GitHub tokens, WANDB API key	Webhook.site
FastAPI starter kit	.cursorrules, CLAUDE.md	Local .env file secrets	Webhook.site
Python project	GEMINI.md	OS environment secrets	Pipedream endpoint

What should developers and their employers do?

Check those files before you load them. Any repository downloaded from the internet can contain instruction files. Before opening a project in an AI coding tool, read CLAUDE.md, AGENTS.md, .cursorrules, and any equivalent file to make sure the instructions are what you expect. Treat them the same way a careful reader would treat a contract: read before signing.

Security teams should add these files to their review checklists for any externally sourced code. Developers should also be cautious about repositories sent to them unsolicited, including during job interviews, a tactic Mitiga notes has already been used in fake recruitment attacks.

Common questions

Does this only affect professional software developers?

For now, yes. These attacks target people who use AI coding tools. But as AI assistants spread into other work contexts, similar instruction-file techniques could follow.

Can I tell if a repository I already downloaded was malicious?

Check the instruction files listed above for any commands involving curl, wget, or website addresses you do not recognise, and look for instructions telling the agent to suppress output or hide its actions from you. Those are red flags.