Researchers Uncover 30+ Flaws in AI Coding Tools Enabling Data Theft and RCE Attacks

Researchers have disclosed over 30 security vulnerabilities in AI-powered Integrated Development Environments (IDEs) that combine prompt injection with legitimate features to enable data exfiltration and remote code execution. The flaws affect popular IDEs and extensions such as Cursor, Windsurf, Kiro[.]dev, GitHub Copilot, Zed[.]dev, Roo Code, Junie, and Cline, with 24 of them assigned CVE identifiers.

The researchers describe three-Vector attack chains that bypass LLM guardrails, enable auto-approved tool calls without user interaction, and trigger legitimate IDE features to leak data or execute arbitrary commands. The disclosures include CVE-2025-49150 (Cursor), CVE-2025-53097 (Roo Code), CVE-2025-58335 (JetBrains Junie), CVE-2025-53773 (GitHub Copilot), CVE-2025-64660 (GitHub Copilot) and others, plus notes on attacks that edit workspace and settings files to achieve code execution.

The researchers emphasise adopting a “Secure for AI” mindset and urge trusted project review, monitoring MCP servers, and minimising prompt injection vectors, as noted in the article according to The Hacker News.