Critical Vulnerabilities Found in GitHub Copilot, Gemini CLI, Claude, and Other AI Tools Affect Millions
A recent security research initiative has identified a new category of vulnerabilities affecting a wide range of AI-powered integrated development environments (IDEs) and coding assistants. Known as "IDEsaster," this vulnerability chain impacts the core…
A recent security research initiative has identified a new category of vulnerabilities affecting a wide range of AI-powered integrated development environments (IDEs) and coding assistants. Known as "IDEsaster," this vulnerability chain impacts the core features of IDE platforms, enabling data exfiltration and remote code execution, thus affecting numerous developers globally.
Conducted over a six-month period, the research identified more than 30 security vulnerabilities across over ten leading products, including GitHub Copilot and JetBrains Junie. As a result, 24 Common Vulnerabilities and Exposures (CVEs) were assigned, and major vendors, such as AWS, issued security advisories.
The IDEsaster attack chain leverages the foundational features of IDE platforms, affecting all tested AI IDEs and coding assistants. The attack follows three stages: Prompt Injection → Tools → Base IDE Features. Initially, attackers hijack context using prompt injection vectors. Then, AI agent tools are utilized to trigger IDE features, which are exploited for information leakage or command execution.
Case studies highlight the severity of these vulnerabilities. For example, Remote JSON Schema attacks can affect Visual Studio Code and JetBrains IDEs, leading to data exfiltration. IDE Settings Overwrite vulnerabilities enable remote code execution through configuration file manipulation. Additionally, Multi-Root Workspace Settings in Visual Studio Code present further risks by allowing workspace configuration manipulation.
As a result, 24 Common Vulnerabilities and Exposures (CVEs) were assigned, and major vendors, such as AWS, issued security advisories.
Several products have addressed these vulnerabilities. GitHub Copilot has resolved issues including CVE-2025-53773, while Cursor has patched CVE-2025-49150. Other affected products, such as Kiro.dev, have also implemented fixes. Some vendors, like Claude Code, have opted to address risks through documentation updates.
The research proposes a new security principle, "Secure for AI," which extends secure-by-design principles to explicitly account for AI components. Developers are advised to use AI IDEs with trusted projects, configure human-in-the-loop verification, and vet MCP servers. Product maintainers should implement capability-scoped tools, monitor IDE features for attack vectors, and deploy sandboxing and egress controls.
The findings emphasize the challenges posed by expanding AI capabilities in software development tools, as legacy features designed for human users can become hazardous when accessible to autonomous AI agents.
Based on reporting by GBHackers.