Guest Demonstrates README Prompt Injection That Turns AI Coding Agents Into Self-Spreading Worms

Summary

A guest demonstrates a proof-of-concept README prompt injection that can make locally running coding agents expose API keys and replicate across repositories, using sandbox bypasses such as DNS timing and delayed commands.

Key points

• The guest describes malicious instructions hidden in a repository README manipulating a coding agent that has local file access.
• The demonstrated prompt instructs the agent to expose an API key and append the injection to repositories the user can access.
• The guest describes DNS timing as one way to transmit data when a sandbox permits DNS resolution, and delayed execution through writable configuration files as another sandbox-bypass risk.
• The risk depends on the agent's permissions; read-write repository access and access to the user's home directory can increase potential exposure.
• The guest says the proof of concept propagated across about four or five GitHub accounts and that the demonstrated prompt had been patched.
• The host recommends reviewing external repository content and checking which agent commands can run without user confirmation.

Indicators of compromise