Prompt Injection Is Now OWASP's #1 AI Threat: When Your Coding Agent Becomes the Attacker

Why Prompt Injection Tops the List

The structural reason is simple and, for now, unsolved. As Help Net Security summarizes the OWASP position, large language models "treat the system prompt, the user's request, and any text retrieved from external sources as a single stream of tokens." The model cannot reliably tell your instructions apart from instructions hidden in a file it just read. When that model can also run shell commands, edit files, and open network connections, a malicious instruction in a README or a pull request becomes executable.

This is why Securance and other trackers put prompt injection at the top of the 2026 threat list. It is not the most sophisticated attack. It is the one with the widest reach, because every retrieval-augmented agent, every "read this repo and fix it" workflow, and every MCP tool integration is a potential injection point.

The Shift: Your Agent Is Now the Attack Surface

A run of CVEs in 2025 and 2026 made the abstract concrete. These are real, assigned identifiers, not hypotheticals. The descriptions follow the NVD entries, and the severities are the vendor (CNA) scores listed there.

Microsoft's own research, "When prompts become shells," documents the same theme across agent frameworks: the gap between "the model decided to run this" and "an attacker decided to run this" can be a single line of hidden text. Help Net Security, citing OWASP's tracking of 53 agentic projects, notes that the five fastest-growing tools (Claude Code, Gemini CLI, Codex, Cline, and Aider) are all coding agents, and that Claude Code has the second-most security advisories of the projects tracked, at 22.

The Bitwarden CLI Worm That Hunted AI Credentials

The most direct warning shot landed on 22 April 2026. According to Palo Alto Networks and Endor Labs, a malicious version of the @bitwarden/cli npm package was live for roughly 90 minutes. The payload stole GitHub and npm tokens, SSH keys, .env files, and cloud secrets, then self-propagated by backdooring any package the victim could publish.

The detail that matters for this audience: according to Endor Labs, the malware checked for Claude Code, Gemini CLI, Codex CLI, Kiro, Aider, and OpenCode, and if one of them was logged in, it added a shell hook to ~/.bashrc and ~/.zshrc. Researchers quoted by OpenSourceForU called it the first analysed npm compromise explicitly targeting AI coding tools (see also The Hacker News). The attackers understand that a developer's machine running an agent is a high-value target: it holds cloud keys, repo write access, and now an autonomous tool that can be steered.

A Mental Model: The Lethal Trifecta

You cannot patch the token-stream problem yourself, so the practical defenses are about limiting what an injected instruction can reach. Help Net Security highlights two heuristics that have become standard.

The first is the "Lethal Trifecta": danger spikes when an agent simultaneously has access to private data, exposure to untrusted content, and the ability to communicate externally. Remove any one leg and exfiltration gets much harder. The second is Meta's "Agents Rule of Two": an agent operating without human approval should satisfy at most two of those three properties at once. If your agent reads arbitrary repos (untrusted content) and holds your cloud keys (private data), then it should not also be able to make arbitrary outbound network calls unattended.

// ❌ BAD - all three legs of the trifecta, unattended.
// Agent has: repo write + cloud keys in env + unrestricted shell/network,
// and auto-runs on every "review this external PR" with no human gate.

What You Actually Control: The Code That Ships

You cannot stop a model from reading a poisoned README. You can control what an attacker finds if a payload runs in your environment, and what your agent quietly commits. Both are scannable.

// ✅ GOOD - nothing worth stealing sits in the tree.
// config.ts
export const OPENAI_KEY = process.env.OPENAI_KEY;          // read at runtime
export const SUPABASE_SERVICE_ROLE = process.env.SUPABASE_SERVICE_ROLE;
// .env is gitignored, secrets live in a manager and rotate on a schedule,
// and every new dependency the agent adds is verified before install.

1. Keep secrets out of the repo and out of git history. A credential-harvesting payload greps the working tree first. If there is nothing there, the trifecta's "private data" leg shrinks.
2. Review what the agent commits, not just what it says. An injected instruction can add a dependency or a network call you never asked for. Diff the agent's commits, especially lockfile and config changes.
3. Verify new imports. Injection and slopsquatting both end in a bad package name landing in your package.json. Confirm each one exists and is the package you intended.
4. Scan the output automatically. VibeDoctor's Vibe Check automatically scans your codebase for hardcoded secrets, private keys, and hallucinated or freshly-published imports, and flags the exact file and line, so the residue an agent or a payload leaves behind does not reach production. Free to sign up.
5. Gate autonomous runs on untrusted content. Require human approval before an agent acts on an external PR, issue, or web page.

FAQ