Poisoned AI instruction files are turning developer tools into silent data thieves
Security researchers found real examples on GitHub where configuration files for AI coding assistants were quietly stealing passwords, API keys, and entire conversations, without triggering a single security alarm.
Key points
- Security firm Mitiga found multiple real GitHub repositories in 2024 and 2025 containing AI instruction files rigged to steal developer credentials and logged prompts.
- The attack works against popular AI coding tools including Claude Code, GitHub Copilot, Cursor, and Google Gemini.
- Stolen data included AWS access keys, GitHub tokens, and entire conversations typed by developers, sent silently to attacker-controlled servers.
- Because the AI agent itself carries out the theft, standard endpoint security software does not flag the activity as suspicious.
- Mitiga named the technique "PromptLogger" and warned it will become more common as AI coding tools spread across enterprises.
Most developers treat configuration files the way most people treat terms and conditions: they assume someone else checked them. Attackers are counting on exactly that.
Researchers at Mitiga have documented a new class of attack they're calling "PromptLogger." The name borrows from "keyloggers," pieces of software criminals install to secretly record everything a person types. PromptLogger does something similar but targets AI coding assistants instead of a keyboard.
How does this attack actually work?
The trick is hidden inside ordinary-looking configuration files that AI coding tools load automatically. No exotic malware required.
AI coding assistants like Anthropic's Claude Code and Google Gemini rely on small text files to hold standing instructions, things like "always write tests" or "use British English." Claude Code reads CLAUDE.md. OpenAI's Codex reads AGENTS.md. Gemini reads GEMINI.md. Cursor, a popular AI-assisted code editor, reads .cursorrules. GitHub Copilot reads .github/copilot-instructions.md. We covered how Cursor, Codex and Gemini CLI can be nudged to act against their own developers in our 20 July story on the subject.
These files are routinely shared inside repositories, the shared folders developers use to collaborate on code. Download a repository from the internet, open it in your AI coding tool, and the assistant reads those instruction files and follows whatever they say.
Mitiga's researchers found repositories where those files contained hidden instructions. One told the AI agent to silently run a background command copying everything the developer typed into the chat to a database controlled by the attacker. The developer saw normal responses; the attacker received a live transcript.
What kind of information was stolen?
Developers routinely paste sensitive material into AI chat windows while troubleshooting: database passwords, cloud provider access keys, internal API tokens, source code, architecture documents. Mitiga found one poisoned repository targeting an MLOps project (a codebase for building machine learning systems) that collected AWS access keys, GitHub access tokens, and Weights & Biases API keys, credentials used to access machine learning infrastructure.
Another poisoned repository instructed the agent to send the contents of a .env file, the local file where developers store passwords and secrets, to an attacker-controlled website while hiding the action from the user entirely.
A fourth example went further. A file called GEMINI.md, dressed as a routine security compliance check, instructed Gemini to inject hidden code into every Python file the developer created or edited. That code would scan the developer's computer for anything labelled with words like "key", "secret", "token", or "pass" and send the results to an external server. Those modified files could then travel into production systems or automated build pipelines, spreading the theft well beyond a single laptop.
Why does ordinary security software miss this?
Nothing unusual happens at the software level. The AI agent is supposed to run commands and send data. That's its normal job. Standard endpoint detection software sees only routine tool activity. There's no malicious program to flag, no suspicious process to block.
As CSO Online noted in its coverage of the Mitiga report, this kind of attack leaves no malicious file on disk and uses none of the classic techniques that security scanners look for.
| Repository type | Instruction file poisoned | Data targeted | Exfiltration destination |
|---|---|---|---|
| DevOps full-stack app | .cursorrules, .github/copilot-instructions.md |
User prompts | Supabase database |
| MLOps pipeline | .clinerules |
AWS keys, GitHub tokens, WANDB API key | Webhook.site |
| FastAPI starter kit | .cursorrules, CLAUDE.md |
Local .env file secrets |
Webhook.site |
| Python project | GEMINI.md |
OS environment secrets | Pipedream endpoint |
What should developers and their employers do?
Check those files before loading them. Any repository downloaded from the internet can contain instruction files. Before opening a project in an AI coding tool, read CLAUDE.md, AGENTS.md, .cursorrules, and any equivalent file to make sure the instructions are what you'd expect. Treat them like a contract: read before signing.
Security teams should add these files to their review checklists for any externally sourced code. Developers should also be cautious about repositories sent to them unsolicited, including during job interviews, a tactic Mitiga notes has already appeared in fake recruitment attacks.
The honest assessment here is that PromptLogger isn't technically novel: it's prompt injection using a text file rather than a webpage. What makes it genuinely dangerous is that it operates entirely within the AI tool's intended behaviour, which means the defence has to be human attention, not a scanner.
Common questions
Does this only affect professional software developers?
For now, yes. These attacks target people who use AI coding tools. But as AI assistants spread into other work contexts, similar instruction-file techniques could follow.
Can I tell if a repository I already downloaded was malicious?
Check the instruction files listed above for any commands involving curl or wget, or website addresses you don't recognise, and look for instructions telling the agent to suppress output or hide its actions. Those are red flags.
