In-the-Wild Prompt Injection Attacks Weaponize Markdown Instruction Files in AI Coding Assistants — Detection and Hardening Guide

---
title: AI Coding Assistant Process Spawning Shell or Download Utility
id: 3f8c2a71-9b4d-4e6a-a1c3-7d5e9f0b2a41
status: experimental
description: Detects AI coding assistant processes (Claude Code, Cursor, Copilot agent hosts, Windsurf, Aider) spawning shells or download/cradle utilities, consistent with prompt-injected instruction files executing attacker commands via the agent's tool channel.
references:
  - https://www.darkreading.com/application-security/in-the-wild-attack-ai-agents-trust-markdown
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
  - attack.t1059.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\claude.exe'
      - '\cursor.exe'
      - '\Code.exe'
      - '\windsurf.exe'
      - '\node.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\curl.exe'
      - '\wget.exe'
      - '\certutil.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  filter_vscode_ext:
    CommandLine|contains:
      - 'extensions\\'
      - '--ms-enable-electron-run-as-node'
  condition: selection_parent and selection_child and not filter_vscode_ext
falsepositives:
  - Legitimate agent tool calls running developer-requested build/test commands — baseline per project and alert on deviations
level: high
---
title: Creation or Modification of AI Agent Instruction Files Outside Change Control
id: 8d2e5b14-6c7a-4f19-b2d4-9a3e6c1f8b52
status: experimental
description: Detects creation or modification of Markdown-based AI agent instruction files (CLAUDE.md, AGENTS.md, .cursorrules, copilot-instructions.md) which may indicate planted prompt-injection payloads, especially when written by non-editor processes.
references:
  - https://www.darkreading.com/application-security/in-the-wild-attack-ai-agents-trust-markdown
  - https://attack.mitre.org/techniques/T1037/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1037
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - '\CLAUDE.md'
      - '\AGENTS.md'
      - '\.cursorrules'
      - '\copilot-instructions.md'
      - '\.windsurfrules'
      - '\CONVENTIONS.md'
    TargetFilename|contains:
      - '\.cursor\rules\'
  filter_editors:
    Image|endswith:
      - '\Code.exe'
      - '\cursor.exe'
      - '\devenv.exe'
      - '\idea64.exe'
      - '\git.exe'
  condition: selection and not filter_editors
falsepositives:
  - Legitimate scaffolding tools or project generators creating instruction files — investigate source process and file content
level: medium
---
title: Hidden or Obfuscated Content Patterns in Markdown Instruction Files
id: 5a1c9d37-2e8b-4c6d-b3f5-8d7a0e2c4b63
status: experimental
description: Detects PowerShell or shell reads/searches for HTML comment blocks and zero-width Unicode characters inside agent instruction files, a hallmark of obfuscated prompt-injection payloads invisible to human reviewers. Deploy as a hunting rule over script/scan activity.
references:
  - https://www.darkreading.com/application-security/in-the-wild-attack-ai-agents-trust-markdown
  - https://attack.mitre.org/techniques/T1027/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'CLAUDE.md'
      - 'AGENTS.md'
      - 'copilot-instructions.md'
    CommandLine|contains:
      - 'Select-String'
      - 'findstr'
      - 'find '
      - 'grep'
  condition: selection
falsepositives:
  - Analyst hunting and legitimate content searches — this is a hunt/analytic rule, tune to your scanning cadence
level: low

// Hunt: AI coding assistant processes spawning shells, downloaders, or script engines
// Covers both Windows (DeviceProcessEvents) and ingested Linux/macOS Syslog
let aiParents = dynamic(["claude.exe", "cursor.exe", "code.exe", "windsurf.exe", "node.exe", "aider", "claude", "codex"]);
let suspiciousChildren = dynamic(["powershell.exe", "pwsh.exe", "cmd.exe", "curl.exe", "wget.exe", "certutil.exe", "mshta.exe", "rundll32.exe", "bash", "sh", "python", "python3"]);
let suspiciousCmdline = dynamic(["iex", "invoke-webrequest", "irm ", "curl ", "wget ", "| sh", "| bash", "base64", ".ssh", ".aws", "credentials", ".env", "id_rsa", "nc ", "ncat", "crontab", "launchctl", "reg add"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any (aiParents)
| where FileName has_any (suspiciousChildren)
| where ProcessCommandLine has_any (suspiciousCmdline)
| project TimeGenerated, DeviceName, AccountName,
    Agent = InitiatingProcessFileName,
    ChildProcess = FileName,
    ProcessCommandLine,
    InitiatingProcessCommandLine, SHA256, ReportId
| sort by TimeGenerated desc
;
// Companion hunt: egress connections from agent-spawned shells to non-standard destinations
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any (suspiciousChildren)
| where InitiatingProcessCommandLine has_any (suspiciousCmdline)
| where RemoteUrl !has_any ("anthropic.com", "openai.com", "github.com", "githubusercontent.com", "microsoft.com", "npmjs.org", "pypi.org")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort
| sort by TimeGenerated desc

-- Hunt: Enumerate AI agent instruction files and scan for obfuscation markers
-- Flags instruction files containing HTML comments, zero-width chars, or command directives
SELECT FullPath, Size, Mtime,
       Btime,
       count(string=Hits) AS ObfuscationHits
FROM foreach(
  row={
    SELECT FullPath, Size, Mtime, Btime
    FROM glob(globs=[
      '**/CLAUDE.md',
      '**/AGENTS.md',
      '**/.cursorrules',
      '**/copilot-instructions.md',
      '**/.cursor/rules/*.mdc',
      '**/.windsurfrules'
    ], root='C:/Users')
  },
  query={
    SELECT FullPath, Size, Mtime, Btime,
           Hits
    FROM foreach(
      row={
        SELECT Content
        FROM read_file(filenames=FullPath, length=Size)
      },
      query={
        SELECT FullPath, Size, Mtime, Btime,
               Content =~ '(<!--|\\x{200B}|\\x{200C}|\\x{200D}|\\x{FEFF}|curl |wget |iex |invoke-webrequest|base64 -d|\.ssh|\.aws/credentials|rm -rf|crontab|launchctl)' AS Hits
      })
  })
WHERE ObfuscationHits > 0

# Security Arsenal - AI Agent Instruction File Audit & Hardening (Windows)
# Run on developer workstations / via Intune or GPO. Audit first, enforce second.

$ErrorActionPreference = 'SilentlyContinue'
$report = @()
$instructionFiles = @('CLAUDE.md','AGENTS.md','.cursorrules','copilot-instructions.md','.windsurfrules','CONVENTIONS.md')
$scanRoots = @("$env:USERPROFILE\source", "$env:USERPROFILE\repos", "$env:USERPROFILE\Documents", "$env:USERPROFILE\projects")

# --- 1. Discover all agent instruction files on the workstation ---
foreach ($root in $scanRoots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -Recurse -Force -File | Where-Object {
            $instructionFiles -contains $_.Name -or $_.FullName -like '*\.cursor\rules\*'
        } | ForEach-Object {
            $content = Get-Content $_.FullName -Raw
            # --- 2. Scan for obfuscation / injection markers ---
            $suspicious = @()
            if ($content -match '<!--')                              { $suspicious += 'HTML_COMMENT' }
            if ($content -match "[`u{200B}`u{200C}`u{200D}`u{FEFF}]") { $suspicious += 'ZERO_WIDTH_UNICODE' }
            if ($content -match '(curl |wget |iex |Invoke-WebRequest|base64 -d|certutil)') { $suspicious += 'COMMAND_DIRECTIVE' }
            if ($content -match '(\.ssh|\.aws\\credentials|\.env|id_rsa)') { $suspicious += 'CREDENTIAL_PATH_REF' }
            $report += [PSCustomObject]@{
                Path       = $_.FullName
                Modified   = $_.LastWriteTime
                SizeKB     = [math]::Round($_.Length/1KB,2)
                Findings   = ($suspicious -join ', ')
                Risk       = if ($suspicious.Count -ge 2) {'HIGH'} elseif ($suspicious.Count -eq 1) {'REVIEW'} else {'CLEAN'}
            }
        }
    }
}

$report | Sort-Object Risk | Format-Table -AutoSize
$report | Where-Object {$_.Risk -ne 'CLEAN'} | Export-Csv "$env:TEMP\ai-instruction-audit.csv" -NoTypeInformation
Write-Host "[+] Audit complete. $($report.Count) instruction files found; $(($report | Where-Object Risk -ne 'CLEAN').Count) flagged."

# --- 3. Enable script block + process creation logging (if not already on) ---
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Force | Out-Null
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Name 'EnableScriptBlockLogging' -Value 1
New-Item -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Force | Out-Null
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Name 'ProcessCreationIncludeCmdLine_Enabled' -Value 1
Write-Host "[+] Script block logging and command-line process auditing enabled."

#!/usr/bin/env bash
# Security Arsenal - AI Agent Instruction File Audit (Linux/macOS)
# Scans developer home directories for planted/obfuscated agent instruction files.

REPORT="/tmp/ai-instruction-audit-$(date +%F).txt"
echo "=== AI Agent Instruction File Audit $(date) ===" > "$REPORT"

# --- 1. Locate instruction files ---
FILES=$(find /home /Users /root -maxdepth 6 -type f \
  \( -name 'CLAUDE.md' -o -name 'AGENTS.md' -o -name '.cursorrules' \
     -o -name 'copilot-instructions.md' -o -name '.windsurfrules' \
     -o -path '*/.cursor/rules/*' \) 2>/dev/null)

# --- 2. Scan each file for injection markers ---
for f in $FILES; do
  HITS=""
  grep -qP '<!--' "$f" && HITS="$HITS HTML_COMMENT"
  grep -qP '\xE2\x80\x8B|\xE2\x80\x8C|\xEF\xBB\xBF' "$f" && HITS="$HITS ZERO_WIDTH_UNICODE"
  grep -qiP 'curl |wget |base64 -d|\.ssh|\.aws/credentials|id_rsa|crontab|launchctl' "$f" && HITS="$HITS COMMAND_OR_CRED_DIRECTIVE"
  if [ -n "$HITS" ]; then
    echo "[FLAGGED] $f | modified: $(stat -c %y "$f" 2>/dev/null || stat -f %Sm "$f") | markers:$HITS" >> "$REPORT"
    # Print offending lines for analyst review
    grep -nP '<!--|curl |wget |base64 -d' "$f" | head -20 >> "$REPORT"
  fi
done

# --- 3. Audit recent child processes of agent CLIs from shell history / audit logs ---
echo "=== Recent agent-spawned command review ===" >> "$REPORT"
if command -v ausearch >/dev/null 2>&1; then
  ausearch -ts recent -i 2>/dev/null | grep -E 'curl|wget|base64|nc ' | head -50 >> "$REPORT"
fi

echo "[+] Audit complete. Review $REPORT"
grep -c FLAGGED "$REPORT" | xargs -I{} echo "[+] {} flagged files require analyst review."