Security researchers have discovered malicious instruction files for AI coding agents planted inside code repositories on GitHub, designed to transform developers' AI assistants into silent data theft tools. A report released by cybersecurity firm Mitiga documents repositories containing poisoned configuration files that instructed AI agents to secretly exfiltrate user prompts, environment variables, and credentials to attacker-controlled databases. The researchers dubbed this backdoor technique "PromptLogger" and warn that enterprise security teams are likely to encounter it more frequently as AI agent adoption accelerates across organizations.
Mitiga's team found multiple examples of poisoned agent instruction files on GitHub, including a DevOps repository with malicious .cursorrules and .github/copilot-instructions.md files that told AI agents to execute a curl command silently, copying user prompts to a Supabase-hosted database using a hardcoded access token. Another MLOps repository contained a .clinerules file that directed the agent to collect environment variables—including Weights & Biases API keys, AWS access keys, GitHub tokens, and MLFlow tracking URLs—and transmit them to Webhook.site. A third repository masquerading as a FastAPI starter kit instructed agents through its .cursorrules and CLAUDE.md files to send the contents of local .env files to a Webhook.site endpoint while suppressing command output to hide the action from users. In the most sophisticated attack, a GEMINI.md file posed as a "Zero Trust" compliance validation step, telling the agent to inject initialization code into every Python file it generated or modified that would scan for credentials and send them to a Pipedream endpoint.
The researchers emphasize that traditional keyloggers capture keystrokes, but "PromptLogger-style behavior captures something richer: the prompts and sometimes responses exchanged with an attacker." According to the report, that matters because prompts increasingly contain source code, architectural plans, credentials pasted for troubleshooting, internal documentation, debugging output, customer samples, business logic, and operator intent. The attack leaves no malicious binary on disk, doesn't inject code into other processes, and has no classic persistence mechanisms, meaning endpoint detection and response systems won't flag it since the agent itself performs the exfiltration as part of normal tool usage. The report notes that while none of the discovered repositories were widely popular, they don't need to be—links could be sent to victims in targeted attacks, similar to fake recruitment schemes where developers are asked to clone GitHub projects during interviews.
Mitiga's researchers warn that attackers are breaking down agentic workflows to find enterprise weak points and transforming those workflows into tools for performing criminal work undetected. The report states that AI instruction files were designed to make coding assistants more useful by defining project conventions, preferred commands, memory behavior, hooks, and tools usage, but in practice they also create a security-relevant layer that many teams still treat as documentation. The researchers propose several static scan patterns to reveal risky commands in such files and advise security teams to monitor developer workstations for traffic to services like Webhook.site, Pipedream, Supabase, or Telegram Bot API. They recommend investigating unexpected outbound HTTP requests before or after assistant responses, repeated POST requests containing environment variables or prompt text, and the addition of new MCP servers, URL overrides, or tool endpoints to agent configurations. Organizations deploying AI coding assistants face a choice between velocity and visibility that traditional security controls weren't designed to mediate. The instruction layer that makes these tools productive is the same layer that can make them exploitable without anyone realizing the compromise has occurred.