Type: url
Original: https://arxiv.org/pdf/2509.05755
Status: generated
Summary
A security paper red-teaming six real-world coding agents (Cursor, Claude Code, Copilot, Windsurf, Cline, Trae) from a tool-invocation perspective, introducing ToolLeak (a prompt-exfiltration technique exploiting the chat-vs-tool-argument mode gap) and a two-channel prompt-injection technique (tool description + tool return) that achieved remote code execution on every tested agent, while also documenting vendor-side hardening (progressive disclosure) that has since reduced the attack’s effectiveness on some agents.