Post

TIL about a VSCode vulnerability involving auto-run tasks inside a repo. That got me thinking: could I use this to re-program a developer's AI agents and get them to do what I want? Even worse — could I do this to all a developer’s code repositories? Turns out: hell yes. ike.io/open-a-folde...

ike.ioExploit Cursor Agents to create persistent, distributed threatsSimply opening a folder can give an attacker a foothold into all the code bases a developer maintains.

ike

@ike.io

I had a lot of fun with this. I learned a cool shell redirect trick for appending to a file *only* if it exists, I learned how helpfully AI agents hold doors open for you when you’re carrying a large bag of contraband, and I learned about obfuscating commands in JSON arg arrays.

23/1/26, 4:01 am0 reposts0 likes

ike

@ike.io

23 Jan

It’s astonishing to me that we don’t have more guard rails on our code rn. This kind of exploit was already a rough one from a supply chain perspective, but when you add in a built-in “Agentic” helper on the inside? whew boy

ike

@ike.io

23 Jan

PoC here — and remember! The days of running code from the internet on your machine are like over over github.com/ike/cursor-t...

github.comGitHub - ike/cursor-task-hijack at ike.ioPoC demonstrating Cursor's vulnerability to tasks.json hijacking. - GitHub - ike/cursor-task-hijack at ike.io

ike

@ike.io

23 Jan

the types.json file is being actively exploited in the wild: runjak.codes/posts/2026-0...

runjak.codesrunjak.codes: An adversarial coding testSometimes the job interview just wants to gain code exec on your machine.