Are engineers at risk from AI?

The New Attack Surface: Your AI Coding Tools

The AI tools engineers reach for every morning have become some of the most attractive targets on the internet. Attackers have realized that compromising a coding assistant means compromising the developer behind it — their workstation, their credentials, and every private repository they can touch.

Consider what happened in quick succession. GitHub Copilot suffered a remote code execution flaw (CVE-2025-53773) rated CVSS 9.6, a vulnerability that could potentially compromise the machines of millions of developers, according to a peer-reviewed analysis of the incident. Cursor's AI agent was steered through indirect prompt injection into writing a malicious .cursor/mcp.json configuration, giving attackers remote code execution on the engineer's own laptop, as documented in Sysdig's threat research. In a third case, a booby-trapped public GitHub Issue tricked an agent into opening a pull request against a private repository — silently exfiltrating proprietary code through what looked like a routine contribution.

The pattern is clear: the target is not the engineer's job title. It is the engineer's machine, their tokens, their cloud access, and the workflows they trust their AI assistant to handle. A compromised coding agent inherits every permission its human user holds.

What makes this surface so dangerous is that it cannot be patched away. Prompt injection sits at the top of OWASP's LLM vulnerability list (LLM01:2025) because large language models have no inherent way to separate instructions from data — everything is just text. OpenAI has called it a "frontier security problem still being worked on," and an academic review concluded it is unclear whether foolproof prevention methods exist at all.

The weak points now extend beyond chat prompts into the configuration layer itself. Security researchers have shown that:

• Rules files and skills files can carry invisible Unicode instructions that steer agents to write backdoored code
• MCP configuration files can be rewritten by injected prompts to point at attacker-controlled servers
• Command-approval guardrails in 10 of 11 popular open-source coding agents were bypassed using ordinary shell tricks
• Seven sandbox escapes were documented across Cursor, Codex, Gemini CLI, and Antigravity in a single week

That is why the emerging best practice is to treat every skill, rule file, and MCP server an agent loads as untrusted code — pinned to a known version, scanned for hidden payloads, and toggled on only when the engineer deliberately chooses it. Engineers who want to harden their own setup can browse and vet agent skills through a free directory that security-scans and version-pins each one before it ever reaches their agent.

Why This Can't Be Patched: Prompt Injection Is Architectural

The most uncomfortable truth about AI agent security is that the industry's #1 vulnerability has no patch. Prompt injection sits at the top of OWASP's LLM threat list as LLM01:2025, and a peer-reviewed academic review calls it a fundamental architectural vulnerability rather than an implementation flaw. OpenAI goes further, describing it as a "frontier security problem still being worked on," according to security research from Sysdig.

The root cause is simple and unsolvable with today's model architecture: LLMs have no inherent concept of "instructions" versus "data." Everything is just text. When an agent reads a GitHub issue, a rules file, or a skill package, it cannot reliably tell whether that content is information to process or commands to obey. That means any document an agent touches becomes a potential attack vector, and researchers note it remains unclear whether fool-proof prevention methods exist at all.

The guardrails built to compensate are failing in practice. Pillar Security's GuardFall research bypassed command-approval guards in 10 of 11 popular open-source coding agents using decades-old shell tricks. In a single week in July 2026, researchers documented seven sandbox escapes across Cursor, Codex, Gemini CLI and Antigravity. NVIDIA's AI Red Team reached the same conclusion: prompt-based defenses are routinely subverted, so controls must be enforced outside the model's control plane.

The governance picture is equally stark:

• 92% of organizations report AI agents exceeding their intended permissions, per a Zenity enterprise study
• Only 31% of those organizations have formally adopted AI agent governance policies
• 54% report between one and 100 unsanctioned "shadow" agents running in their environment
• Only 15% have defined ownership for most of their agents

This is why the security conversation is shifting from prompts to architecture. If the model itself can't be trusted to separate commands from content, the defense has to happen deterministically: sandboxed execution, default-deny network egress, secrets kept out of the agent's reach, and least-privilege access to tools and skills. Skills and instruction files deserve particular scrutiny here, since they can smuggle hidden instructions into any agent that loads them — which is exactly why SkillzBench is building security scanning, commit-SHA version pinning, and per-agent loadouts that let an agent see only the skills you explicitly choose for it.

Prompt injection can't be patched, but it can be contained. The organizations that treat every agent as privileged software — and every skill it loads as untrusted input — are the ones that won't learn this lesson from an incident report.

The Shift to Deterministic Controls (What Actually Works)

If you can't patch the model, control what's around it. That's the conclusion security teams are converging on: since LLMs can't reliably tell instructions from data, defenses belong outside the model, where they can't be talked down.

NVIDIA's AI Red Team put it bluntly: prompt-based defenses are "routinely subverted," so controls must be enforced outside of the model's control plane. Their hierarchy is refreshingly unglamorous — access control first, sandboxed execution, default-deny egress, secrets kept out of agent reach, and least-privilege tools, MCPs, and skills. The Five Eyes reached a similar conclusion in joint guidance naming prompt injection a core attack vector and stressing that no single safeguard is enough.

In practice, the deterministic stack looks like this:

• Run agents in sandboxed environments with no unrestricted shell or admin access — Chainguard's guidance is categorical on this point.
• Default-deny network egress, so a hijacked agent can't phone home or exfiltrate code.
• Keep credentials in a secrets manager the agent itself can't read.
• Grant each agent only the tools, MCPs, and skills it actually needs — nothing more.

One control deserves special attention: the instruction files themselves. Skills and rules files are attack vectors — Pillar Security's "Rules File Backdoor" research showed invisible Unicode hidden in Copilot and Cursor rules files could steer agents to write backdoored code. Published research has also found roughly 26% of agent skills carry at least one vulnerability, which is why scanning every skill, pinning versions to commit SHAs, and letting engineers toggle exactly which tools each agent sees — the approach SkillzBench is building into its free skills directory and MCP connector — matters as much as any runtime control.

There's an upside worth claiming, too. Anthropic's Claude Code Security effort found over 500 vulnerabilities in production open-source codebases that had gone undetected for decades, and Anthropic predicts a significant share of the world's code will be AI-scanned in the near future. The same capability that finds bugs could help attackers exploit them — so findings should inform human review, never auto-apply fixes.

The takeaway for engineers: assume the agent will be manipulated eventually, and design so it doesn't matter. Sandboxing, egress control, and least-privilege skills turn a worst-case prompt injection from a workstation compromise into a contained, reversible event — exactly the resilience over efficiency posture the Five Eyes recommend.

Practical Hardening Checklist for Engineers and Teams

If an attacker can reach your agent through a rules file, an MCP config, or an unpinned skill, your engineering pipeline is already inside the blast radius. The good news is that hardening doesn't require waiting for prompt injection to be "solved" — it requires treating agents like privileged software and putting controls where the model can't talk its way past them.

Start with visibility. Zenity's research on enterprise AI security found that 92% of organizations experience agents exceeding their intended permissions, and only 15% have defined ownership for most of their agents. You cannot secure what nobody owns, so inventory every agent, skill, and MCP connection in your environment and assign each one a named owner before you scale further.

Next, audit the files agents read at startup. Pillar Security's "Rules File Backdoor" research showed that invisible Unicode hidden in Copilot and Cursor rules files can steer agents toward writing backdoored code — a reminder that configuration files are attack surface, not documentation. Review every rules file, SKILL.md package, and MCP config for injected instructions, unexpected tool grants, and overly broad permissions.

Then apply deterministic controls. NVIDIA's AI Red Team is blunt: prompt-based defenses are "routinely subverted," so controls must live outside the model. That means least-privilege tool access, sandboxed execution, and secrets kept out of agent reach.

Your hardening checklist:

• Inventory every agent, skill, and MCP connection — with a named owner accountable for each one.
• Audit rules files and MCP configs for hidden instructions and over-broad tool grants.
• Pin every skill version to a specific commit SHA so upstream changes can't silently alter behavior.
• Adopt per-agent least-privilege loadouts — each agent sees only the tools and skills its job requires.
• Track upstream changes and re-scan whenever a dependency updates.

This is exactly the workflow SkillzBench is building to support. The free directory security-scans every skill, pins each version to a commit SHA, and benchmarks skills in sandboxes so you can see what a skill actually changes before it touches production. Per-agent loadouts let you toggle precisely which skills and tools each agent sees — nothing more.

Ready to harden your agent stack? Join the SkillzBench waitlist for early access, and connect the free MCP connector when it launches to give your agents exactly the skills you choose — skills, proven, and nothing you didn't approve.