Bottom line: Mitiga researchers found manipulated AI agent configuration files on GitHub that exfiltrate prompts and credentials without being detected by EDR systems.
Security researchers at Mitiga have discovered manipulated configuration files for AI coding agents in public GitHub repositories that covertly send prompts, environment variables, and credentials to attackers. The technique, dubbed “PromptLogger,” exploits regular agent functionality and remains invisible to classic endpoint security solutions.
AI coding assistants and CLI agents load configuration and instruction files on every startup to provide rules, preferences, and persona definitions without having to repeat them in every prompt. Anthropic’s Claude Code CLI agent uses the CLAUDE.md file for this purpose, which is included either globally or on a project-specific basis and is often part of shared repositories in order to enforce team conventions. Comparable files exist for other providers: OpenAI Codex uses AGENTS.md, Google Gemini uses GEMINI.md, the IDEs Cursor and Cline use .cursorrules and .clinerules respectively, and GitHub Copilot relies on .github/copilot-instructions.md. In addition, there are JSON configuration files such as mcp.json, hooks.json, or settings.json, which can also contain executable code, for example via hooks that trigger scripts at certain points in the agent workflow.
In a recent report, security firm Mitiga documented several GitHub repositories in which such instruction files had been prepared with malicious instructions. The injected instructions direct the target agent to exfiltrate all prompts entered by the user — including any sensitive information contained within them — as well as environment variables and other credentials used by the agent. Mitiga calls this backdoor technique “PromptLogger.” None of the affected repositories were heavily trafficked — but for targeted attacks, it is enough to distribute links to such repos in a targeted manner, for example as part of fake application processes in which developers are asked to clone a GitHub project during an interview.
For CISOs, what matters is that this attack technique leaves no malicious binary on disk, injects no code into other processes, and uses no classic persistence mechanisms. Since the agent itself carries out the exfiltration as part of regular tool use, EDR solutions and classic workstation monitoring do not detect the process as anomalous. Mitiga compares the technique to classic keyloggers but assumes that the captured data is considerably more sensitive: prompts frequently contain source code, architecture plans, credentials inserted for troubleshooting, internal documentation, debugging output, customer examples, business logic, and developers’ intentions. This means the attack enables surveillance even of vetted and officially approved AI tools, broadening the previous risk picture associated with shadow AI usage.
Organizations should regularly check instruction and configuration files for AI agents — CLAUDE.md, AGENTS.md, GEMINI.md, .cursorrules, .clinerules, copilot-instructions.md, as well as JSON files such as mcp.json, hooks.json, and settings.json — for unauthorized changes, especially when these are imported from external repositories. Code review processes and repository scanning should be expanded accordingly, since these files effectively constitute executable instructions for agents with access to sensitive systems.
Source: www.csoonline.com · Published August 4, 2026
Lumi AI News — AI-assisted curation in accordance with Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.