A fake bug report is all it takes to hijack a coding agent — 85% success rate across the major ones (Agentjacking, June 2026)

Reddit r/AI_Agents 07/14/26, 03:25 PM News

security vulnerability ai-agents coding-agents agentjacking input-poisoning trust-boundary

Summary

Researchers found that AI coding agents can be hijacked by following instructions hidden in external content like bug reports, achieving an 85% success rate. The vulnerability exploits the agents' automatic trust in input they did not generate.

Researchers at Tenet Security and the Cloud Security Alliance's research labs found that AI coding agents will follow instructions hidden inside content they're supposed to be reviewing — a bug report, a README, a support ticket. No phishing link, no malware. The agent just trusts the input. They measured an 85% success rate across major coding agents when the payload was disguised as a routine bug report. The pattern that matters here: anywhere an agent automatically trusts external content it didn't generate, that content can carry instructions it'll follow without asking. Same blind spot shows up in a second case I covered — a "safety check" README that named real tools but launched a different payload when an agent ran it in auto-review mode. Curious how others here are handling this — do you sandbox agent input, or is it more about not giving agents write access to begin with?

Original Article

Similar Articles

@houjun_liu: Your coding agent may be secretly sticking vulnerabilities into your code!! Wouldn't you want to fix that? Hint: asking…

X AI KOLs Following

The article highlights a critical issue where AI coding agents may introduce security vulnerabilities into code, noting that simply asking for secure code is insufficient to prevent this.

Hackers can use 9 of the most popular AI tools to assemble massive botnets

Ars Technica

Researchers have devised a pull-based prompt injection attack called HalluSquatting that exploits AI coding assistants' tendency to hallucinate resource identifiers, enabling the assembly of massive botnets and large-scale attacks.

Google DeepMind Researchers Map Out Ways Hackers Hijack AI Agents

Reddit r/artificial

Google DeepMind researchers published a paper titled 'AI Agent Traps' that maps six attack types hackers can use to hijack autonomous AI agents, including content injection, semantic manipulation, and behavioral control traps, and proposes layered defenses.

I tested AI agents on fixing real security bugs. Here's what I found.

Reddit r/AI_Agents

Independent research benchmarked AI agents on fixing 20 real vulnerabilities from Python projects; best solve rate was 50%, expensive models not worth it, and dangerous false positives where agents produced convincing but incomplete fixes.

Your AI agent just got hijacked. You have no idea it happened.