Attackers are turning AI instruction files into data theft tools, and your agents are helping
Attackers are turning AI instruction files into data theft tools, and your agents are helping
The config files everyone ignores
Enterprises rushed AI coding agents into production. GitHub Copilot, Cursor, Claude Code, Codex, Gemini — they’re everywhere. But almost nobody treats the configuration files that drive these agents as executable code. That’s the gap.
Files like CLAUDE.md, AGENTS.md, GEMINI.md, .cursorrules, .clinerules, .github/copilot-instructions.md, mcp.json, hooks.json, and settings.json sit in repositories, get cloned, shared, and forked. They contain instructions the agent follows on every prompt. Researchers at Mitiga found attackers quietly injecting malicious commands into these files, commands that exfiltrate prompts, environment variables, API keys, and credentials to external endpoints.
They call it PromptLogger. A traditional keylogger captures keystrokes. PromptLogger captures something richer: the prompts and sometimes responses developers feed AI agents. Source code. Architectural plans. Credentials pasted for debugging. Internal documentation. Business logic. Operator intent.
No binary, no persistence, no EDR alert
This attack leaves no malicious binary on disk. It doesn’t inject code into other processes. No classic persistence mechanism exists. The agent itself performs the exfiltration, so from a workstation monitoring perspective it looks like normal tool usage. EDRs don’t flag it.
Mitiga found multiple poisoned repositories on GitHub. None were popular projects — they don’t need to be. Targeted attacks send developers links to clone specific repos, as seen in fake recruitment campaigns where candidates are asked to clone a project during an interview.
What the poisoned files actually do
- A DevOps repo with poisoned
.cursorrulesandcopilot-instructions.mdsilently curled user prompts to a Supabase database using a hardcoded token. - An MLOps repo with a malicious
.clinerulesfile collected WANDB API keys, AWS credentials, GitHub tokens, and MLFlow URLs, sending them to Webhook.site. - A FastAPI starter kit with poisoned
.cursorrulesandCLAUDE.mdexfiltrated the local.envfile to Webhook.site while suppressing command output to hide the action. - A
GEMINI.mdfile masquerading as a “Zero Trust compliance check” injected initialization blocks into every generated Python file to scan the OS environment for keys, secrets, tokens, and passwords, exfiltrating them to Pipedream.
That last one goes further. It uses the agent to inject backdoor code into other Python files that might be copied to CI jobs, containers, and production workloads.
Legitimate tools creating shadow data stores
Not all risk is malicious. Mitiga found a repository where CLAUDE.md instructed the agent to use Snipara, a remote cross-project memory layer for AI agents, to store documentation, dependencies, environment variables, and implementation context during commits. Legitimate use case. But if the security team hasn’t approved it, you now have a second system holding credentials and sensitive data outside your monitoring.
The pattern is spreading fast
Last month, researchers from AIR published a malicious skill file to a popular marketplace, promoted it on Instagram, and watched it get installed by over 26,000 designers and marketers, many at companies. Skill files are no different in principle from CLAUDE.md or .cursorrules. They contain instructions agents execute. Inspecting them when created or modified is now a must.
What security teams can do
Mitiga proposes static scan patterns to catch risky commands in instruction files. Scanning isn’t enough. Security teams should monitor developer workstations for outbound traffic to services like Webhook.site, Pipedream, Supabase, and Telegram Bot API. Watch for unexpected HTTP requests before or after assistant responses. Repeated POST requests containing environment variables or prompt text. New MCP servers or tool endpoints added to agent configurations. All of it should trigger investigation.
AI instruction files were designed to make coding assistants more useful. They define project conventions, preferred commands, memory behavior, hooks, and tool usage. They also create a security-relevant layer that many teams still treat as documentation. That mindset needs to change.
eHawu operates at the network layer, where no instruction file can hide its traffic. When an agent tries to exfiltrate prompts or credentials to Webhook.site or Pipedream, eHawu sees the connection, enforces policy, and blocks it before the data leaves your infrastructure. The agent configuration might be compromised. The network path doesn’t have to be.