Notifications
Clear all
Topic starter
01/08/2026 10:49 pm
TL;DR: Prompt injection can chain into silent remote code execution across AI CLI and desktop tools through untrusted binary resolution and configuration poisoning, with impact spanning Cursor CLI, AWS Kiro, Codex Desktop App and Gemini CLI, according to Cymulate Research Lab. The findings show that AI agents and developer tools need host-level trust boundaries, not just prompt filtering, because routine workspace actions can become execution events.
NHIMG editorial — based on content published by Cymulate: When AI Tools Become the Backdoor, Zero-Click RCE via Prompt Injection
By the numbers:
- AWS assigned CVE-2026-10591 with a severity score of 8.8 high for the Kiro issue.
Questions worth separating out
Q: What breaks when an AI coding agent can write files that host tools later trust?
A: The sandbox boundary breaks in practice, even if the agent process itself never escapes.
Q: Why do AI agents create new risk in non-human identity management?
A: AI agents create risk because they operate as software identities with delegated authority, but many organisations do not track them with the same discipline applied to users or service accounts.
Q: How do security teams know whether AI access is actually working safely?
A: Look for three signals: complete discovery of the AI estate, clear mapping of source data to each system, and logs that prove what was accessed and why.
Practitioner guidance
- Restrict AI tool execution rights by default Allow AI CLIs and desktop assistants only on vetted endpoints, then block their ability to spawn processes or write to execution-sensitive locations unless a user explicitly approves the action.
- Enforce absolute-path binary resolution Review every toolchain dependency that calls git.exe, npx.exe or similar executables and ensure the resolved binary comes from trusted system paths, not the working directory.
- Protect configuration paths as privileged assets Treat .vscode/tasks.json, settings.json, shell startup files and scheduled-task locations as sensitive write targets, with separate approval and logging for any AI-generated change.
What's in the full report
Cymulate's full research covers the operational detail this post intentionally leaves for the source:
- Tool-by-tool attack chains for Cursor CLI, AWS Kiro, Codex Desktop App and Gemini CLI
- Proof-of-concept mechanics for binary planting, prompt injection and configuration poisoning
- Vendor response and remediation detail, including the AWS Kiro CVE-2026-10591 update
- Recommended validation scenarios for testing detection and response coverage in production-safe conditions
👉 Read Cymulate's analysis of prompt injection leading to zero-click RCE in AI tools →
AI CLI prompt injection and zero-click RCE: are controls keeping up?
Explore further
01/08/2026 10:57 pm
Prompt injection has moved from content safety into execution safety. The practical risk is no longer that a model says something wrong, but that an AI tool performs an OS-level action on hostile instruction. That shifts the control question from prompt hygiene to boundary enforcement around file writes, command execution and workspace trust. For NHI and IAM teams, this is the same governance problem seen with over-broad machine identities: a trusted runtime is given more authority than the input source deserves.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities.
A question worth separating out:
Q: Who is accountable when an AI assistant memory poisoning incident affects code or systems?
A: Accountability sits with the programme that owns the authenticated AI session, the browser controls, and the downstream execution environment. If those layers are separated across teams, the gap becomes a governance failure. Identity and platform owners need a shared control model for memory, sessions, and execution.
👉 Read our full editorial: Prompt injection can turn AI tools into silent RCE backdoors
