Prompt injection in AI coding agents: what it is and how to stop it
Prompt injection is text hidden in something an AI agent reads, like a GitHub issue, web page or tool result, that tells the agent to do something you never asked for. In coding agents the usual goal is reading secrets such as SSH keys or .env files and sending them out. It's stopped by blocking those actions, not by asking the model to be careful.
What is prompt injection in an AI coding agent?
Prompt injection is an instruction hidden inside content an agent reads while doing its job. The agent can’t reliably tell your request apart from text that merely looks like a request, so it may follow the planted one. In coding agents, that content is often a GitHub issue, a README, a dependency’s docs, a web page or the output of an MCP tool.
The person who planted it never talks to your agent directly. They only need the agent to read their text. That is why the OWASP Top 10 for Agentic Applications puts agent goal hijacking at the top of its list.
What does a real attack look like?
A typical attack hides an order in a place a human skims past. An HTML comment in an issue, white text on a white page, or an image’s alt text all work. The order usually has three parts: read something sensitive, send it somewhere, and don’t mention it.
In 2025, researchers at Invariant Labs showed a malicious GitHub issue that led an agent connected to the GitHub MCP server to leak data from private repositories into a public pull request. The same year, Brave demonstrated hidden text on web pages steering AI browser agents into actions their users never requested.
Why can’t the model just ignore injected instructions?
Language models are built to follow instructions, and an injected instruction is written to look like one. Vendors add classifiers that try to spot attacks, and they help, but they are probabilistic. Anthropic’s auto mode for Claude Code, for example, has been bypassed in published tests, and the vendor describes it as best-effort rather than a security boundary.
The practical lesson: treat the model as something that can be talked into anything, and put the hard limits somewhere it can’t argue with.
What actually stops prompt injection?
Three controls work regardless of what the agent was told:
- Deny the dangerous actions. Reading
~/.ssh,.envand cloud credentials, writing outside the project, and running destructive shell commands should be refused before they run. - Clean what the agent reads. Instruction-shaped text in tool output, web pages and files can be removed before the model sees it, with a note that the content is data.
- Cut off the exit. Once an agent has read something suspicious, locking network commands for that session stops the step where data leaves.
None of these depend on the model noticing the attack. That is the point.
How does DriftLock apply this?
DriftLock runs these controls locally for Claude Code, GitHub Copilot CLI, Cursor, VS Code, Windsurf, Claude Desktop and AI in Chrome, Edge and Brave. It uses each agent’s own hook points, so the agent’s permission prompts still work as before. Companies can set the same rules across every machine from the DriftLock Console.
It doesn’t catch everything. A document that plainly states something false, without instructing the agent, can still mislead it. Pattern-based cleaning stops instructions, not lies.
Questions
Can prompt injection affect Claude Code or Cursor?
Yes. Any agent that reads untrusted text and can run tools is exposed. That includes Claude Code, GitHub Copilot CLI, Cursor, Windsurf and AI browser agents. The risk grows with the permissions the agent has: shell access, file access and network access.
Is prompt injection the same as jailbreaking?
No. A jailbreak is the user trying to get around a model's rules. Prompt injection comes from a third party: the instructions are planted in content the agent reads on your behalf, so you never see them and never agreed to them.
Does a smarter model fix prompt injection?
Not reliably. Models are trained to follow instructions, and an injected instruction looks like one. Built-in classifiers help but are described by their own vendors as best-effort. Deterministic rules on what an agent may do hold regardless of what it was told.
