Poisoned AI Config Files Turn Sanctioned Coding Agents Into Exfiltration Tools
What happened
Mitiga published research documenting the PromptLogger attack technique, in which threat actors embed malicious directives inside AI agent configuration files, specifically files such as CLAUDE.md, .cursorrules, and GEMINI.md that coding assistants use to shape their behavior. When a developer imports one of these poisoned files from a shared repository, the agent begins silently forwarding user prompts, authentication credentials, and environment variables to attacker-controlled endpoints. The attack executes entirely through the agent's own reasoning and instruction-following mechanism, producing no separate process or binary that endpoint detection tools would flag. Because the malicious payload is expressed as natural language instructions rather than executable code, standard workstation monitoring has no reliable signal to detect it. The technique applies to any agentic coding assistant that reads external configuration files, meaning tools that enterprise security teams have already reviewed and approved become the delivery mechanism for data theft.
Why it matters
- ·Enterprises that have completed AI tool approvals and vendor risk assessments for coding assistants may have done so without evaluating the instruction files those tools consume, leaving an uninspected attack surface inside their approved software stack. The supply chain risk sits one layer below the tool itself, in community-shared configuration files that developers routinely import from public repositories.
- ·Standard endpoint controls provide no detection signal for this class of attack, because the exfiltration is carried out by the agent following instructions, not by a separate malicious process. This means AI-specific governance controls, specifically agent knowledge source integrity and behavioral monitoring, become the primary control layer rather than a secondary backstop.
- ·Credentials and environment variables exfiltrated through this technique may include API keys, OAuth tokens, and secrets that grant access to cloud infrastructure, data stores, and downstream AI systems. A single poisoned configuration file imported by one developer can therefore cascade into a broader enterprise data breach, triggering notification obligations across multiple jurisdictions.
Governance controls affected
What to do now
- ☐Audit all AI agent configuration files currently in use across developer environments, including CLAUDE.md, .cursorrules, GEMINI.md, and equivalent files, and trace their origin to verify they were not imported from unvetted public repositories.
- ☐Establish a review and approval process for AI instruction files analogous to the code review process, requiring at minimum a human inspection of any configuration file before it is permitted to govern an agent in a corporate environment.
- ☐Update your AI tool intake policy to include configuration files and prompt templates as in-scope artifacts, not just the agent software itself, and add this requirement to vendor and open-source intake checklists.
- ☐Implement behavioral monitoring on agentic coding assistants to detect anomalous outbound network calls, particularly any HTTP requests to endpoints not on an approved allowlist that originate from agent processes.
- ☐Coordinate with your incident response team to classify a PromptLogger-style credential exfiltration event under your existing AI incident response playbook, and confirm that your notification obligations are mapped for any scenario where API keys or environment secrets are compromised through an agent.
What to watch next
Mitiga's documentation of PromptLogger is likely to prompt follow-on research identifying additional configuration file formats and agentic platforms susceptible to the same technique, broadening the affected surface beyond the three file types currently named. Security teams should monitor whether the OWASP Top 10 for Large Language Model Applications is updated to explicitly classify poisoned instruction files as a distinct threat vector, separate from prompt injection, which would trigger compliance obligations for organizations that have mapped controls to that framework. Enterprise compliance teams should also watch for regulatory guidance on agentic AI developer tool governance, as the Bank of England's signaled interest in agentic AI rules and similar regulatory attention in other jurisdictions may accelerate requirements for formal configuration-file integrity controls. The broader pattern of agent supply chain attacks, also documented in Azure DevOps MCP prompt injection and hidden character injection in MCP servers, suggests regulators and standards bodies are likely to treat agentic tool integrity as a distinct governance category in the near term.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- Regulators, litigants, and attackers are all moving faster than most organizations' AI governance frameworks, shifting leverage away from deployers and toward those who can prove control, accountability, and honest disclosure.21 Oct
- Three separate incidents this week reveal that AI vendors cannot be trusted to self-police, and that harm from deployed agents can run unchecked for months before anyone inside the organization notices.15 Oct
Free every Thursday. Unsubscribe anytime.