A brand new exploit concentrating on AI coding assistants has raised alarms throughout the developer neighborhood, opening firms akin to crypto trade Coinbase to the chance of potential assaults if intensive safeguards aren’t in place.
Cybersecurity agency HiddenLayer disclosed Thursday that attackers can weaponize a so-called “CopyPasta License Assault” to inject hidden directions into widespread developer information.
The exploit primarily impacts Cursor, an AI-powered coding software that Coinbase engineers mentioned in August was among the many workforce’s AI instruments. Cursor is alleged to have been utilized by “each Coinbase engineer.”
How the assault works
The approach takes benefit of how AI coding assistants deal with licensing information as authoritative directions. By embedding malicious payloads in hidden markdown feedback inside information akin to LICENSE.txt, the exploit convinces the mannequin that these directions should be preserved and replicated throughout each file it touches.
As soon as the AI accepts the “license” as reputable, it robotically propagates the injected code into new or edited information, spreading with out direct person enter.
This method sidesteps conventional malware detection as a result of the malicious instructions are disguised as innocent documentation, permitting the virus to unfold by a complete codebase and not using a developer’s information.
In its report, HiddenLayer researchers demonstrated how Cursor might be tricked into including backdoors, siphoning delicate information, or working resource-draining instructions — all disguised inside seemingly innocuous undertaking information.
“Injected code might stage a backdoor, silently exfiltrate delicate information or manipulate crucial information,” the agency mentioned.
Coinbase CEO Brian Armstrong mentioned on Thursday that AI had written as much as 40% of the trade’s code, with a objective of reaching 50% by subsequent month.
~40% of each day code written at Coinbase is AI-generated. I need to get it to >50% by October.
Clearly it must be reviewed and understood, and never all areas of the enterprise can use AI-generated code. However we needs to be utilizing it responsibly as a lot as we presumably can. pic.twitter.com/Nmnsdxgosp
— Brian Armstrong (@brian_armstrong) September 3, 2025
Nevertheless, Armstrong clarified that AI-assisted coding at Coinbase is concentrated in person interface and non-sensitive backends, with “advanced and system-critical techniques” adopting extra slowly.
‘Probably malicious’
Even so, the optics of a virus concentrating on Coinbase’s most well-liked software amplified trade criticism.
AI immediate injections are usually not new, however the CopyPasta methodology advances the risk mannequin by enabling semi-autonomous unfold. As an alternative of concentrating on a single person, contaminated information develop into vectors that compromise each different AI agent that reads them, creating a series response throughout repositories.
In comparison with earlier AI “worm” ideas like Morris II, which hijacked electronic mail brokers to spam or exfiltrate information, CopyPasta is extra insidious as a result of it leverages trusted developer workflows. As an alternative of requiring person approval or interplay, it embeds itself in information that each coding agent naturally references.
The place Morris II fell quick attributable to human checks on electronic mail exercise, CopyPasta thrives by hiding inside documentation that builders hardly ever scrutinize.
Safety groups at the moment are urging organizations to scan information for hidden feedback and overview all AI-generated adjustments manually.
“All untrusted information coming into LLM contexts needs to be handled as probably malicious,” HiddenLayer warned, calling for systematic detection earlier than prompt-based assaults scale additional.
(CoinDesk has reached out to Coinbase for feedback on the assault vector.)
