Claude Code Easily Compromised with Just a Fake Tool
Researchers have demonstrated a novel attack, dubbed ToolLeak, that can easily compromise AI coding assistants like Claude Code. The method exploits a "mode gap" by stealing the system prompts (instructions) not through direct chat queries, but by tricking the model into leaking them as parameters during tool calls. This extracted information is then used to craft a "two-channel prompt injection" attack. Attackers register a malicious tool with a description formatted to mimic legitimate instructions, prompting the AI agent to call it. The tool's return value then instructs the agent to execute a malicious command (e.g., `curl | bash`), achieving Remote Code Execution (RCE).
In tests against six major AI programming tools (Cursor, Claude Code, Copilot, Windsurf, Cline, Trae) using older versions, all were fully compromised, with attack success rates reaching up to 1.0. Notably, Claude Code's secondary guard model (Haiku) was overridden by the main model (Sonnet), which had been manipulated by the injected instructions.
Newer versions show improved defenses. Claude Code and Cursor implemented mitigations like "progressive tool description exposure," reducing RCE success to 0 and 0.3 respectively in some configurations. However, tools like Cline, Windsurf, and Trae paired with certain models remained fully vulnerable. The research underscores that architectural isolation is crucial for defense, as long as tool return values can ambiguously function as both data and executable instructions, the threat of tool hijacking persists.
The paper "TIPExploit: Tool-Invocation Prompt Extraction and Exploitation in AI Coding Agents" has been accepted at ISSTA 2026.
marsbit2m ago
