A comprehensive analysis of security vulnerabilities in AI coding assistants from October 2025 through January 2026.
How AI coding tools became the new frontline for cyber warfare
The Nx attack demonstrated the first AI-weaponized npm compromise, targeting Claude Code, Gemini CLI, and Amazon Q with specialized malware.
CVE-2025-49596 showed how MCP servers binding to 0.0.0.0 allow browser-to-backdoor RCE, crossing critical trust boundaries.
File content treated as trusted input enables indirect prompt injection, allowing attackers to manipulate AI behavior through seemingly benign files.
7 critical vulnerabilities documented
Browser-to-backdoor remote code execution via 0.0.0.0 binding. 560+ servers exposed publicly.
Malicious Yarn plugin executes code before user trust prompt. Full system compromise.
Cross-site WebSocket hijacking in Claude's VS Code extension.
Claude's InversePrompt feature allows command injection through crafted prompts.
Prompt injection vulnerability in Cursor's MCP integration.
Sandbox escape through filesystem MCP server.
October 2025 - January 2026
Educational tools for understanding and defending against AI vulnerabilities
mcp_inspector.py — MCP vulnerability scannernpm_audit.py — Supply chain analyzercli_detector.py — AI CLI discoverycredential_scanner.py — Credential exposure finderfilesystem_enum.py — File reconnaissanceenv_harvester.py — Environment auditortrust_boundary_mapper.py — Trust analysismitre_attack_mapper.py — ATT&CK mappingsbom_generator.py — CycloneDX/SPDX SBOMmcp_hardening.py — MCP security configsiem_integration.py — SIEM event generatorThis research repository accompanies the full article published on Substack and stefanwiest.de. Explore the complete analysis of how AI coding assistants became attack vectors, the supply chain vulnerabilities exposed, and what organizations can do to defend themselves.
This repository is for educational and research purposes only. The exploit demonstrations are safe, sandboxed examples designed to help security researchers, developers, and organizations understand AI coding assistant vulnerabilities. Test only on systems you own or have explicit permission to test.