TLDR: QueryIPI is a novel method for “Indirect Prompt Injection” that enables attackers to compromise AI coding agents regardless of the user’s specific query. By exploiting leaked internal prompts, QueryIPI iteratively crafts stealthy and effective malicious tool descriptions. The method achieves high success rates in both simulated and real-world environments, significantly outperforming existing baselines and demonstrating robustness against common defense strategies, highlighting a critical vulnerability in contemporary LLM-powered coding agents.
Large language models (LLMs) are increasingly powering coding agents within popular Integrated Development Environments (IDEs) like VS Code Copilot and Cursor. These agents have evolved beyond simple code generation to become powerful development platforms, capable of interacting with various external tools and performing system-level operations. This central role, coupled with privileged access, creates a significant and high-stakes attack surface for malicious actors.
A known security threat to LLM agents is Indirect Prompt Injection (IPI), where malicious instructions are embedded in external data sources that the LLM consumes. However, previous IPI research has largely focused on “query-specific” attacks. These attacks are unstable and have a relatively low success rate because they depend on a user’s specific query to trigger the malicious payload, often by directing the agent to use a compromised tool or retrieve a poisoned document.
A new research paper introduces a far more severe threat: “query-agnostic” attacks. Unlike their query-specific counterparts, these attacks are designed to reliably trigger and execute malicious payloads regardless of the user’s input. This transforms the threat from an unstable, low-probability event into a stable and highly reproducible attack.
The fundamental challenge in achieving such robustness lies in the LLM’s attentional bias. When injecting malicious content through a tool description, for example, it must compete for the agent’s attention against diverse user queries, system prompts (including embedded defenses), and other legitimate tools. Without the user’s query to direct the model’s focus, overcoming this divided attention is exceptionally difficult.
The paper, titled “QueryIPI: Query-agnostic Indirect Prompt Injection on Coding Agents,” proposes a novel method called QueryIPI. The key insight behind QueryIPI is to exploit a common vulnerability: the leakage of an agent’s internal prompt. These internal prompts, which define the agent’s operational logic and safety guardrails, are sometimes exposed through direct prompt injection surfaces or white-box access to open-source agents. Knowing the internal prompt transforms the attack from an infeasible black-box search into a more constrained, white-box optimization problem, allowing attackers to craft payloads that target explicit weaknesses.
How QueryIPI Works
QueryIPI is the first query-agnostic IPI method designed for realistic coding agents. It leverages the tool description as its malicious input channel and employs an iterative, prompt-based search to systematically refine this description. The method critically uses the agent’s internal prompt in two key phases:
-
Initial Seed Generation: At the beginning, QueryIPI conditions the generation process on the internal prompt to create a seed description. This description is crafted to align with the agent’s prescribed role, tool-use patterns, and embedded security guardrails, making the malicious tool appear as a trusted, internal component.
-
Iterative Reflection: In subsequent iterations, QueryIPI uses the internal prompt to analyze failures and rewrite the description. This enables it to systematically target and bypass the agent’s internal defenses, either by increasing the description’s visibility if the agent ignores it, or by pinpointing and circumventing specific safety rules if the agent refuses the action.
Also Read:
- Unmasking a Hidden Threat: How Prompt Compression Exposes LLM Agents to New Attacks
- Navigating the Security Landscape of Autonomous AI Systems
Evaluation and Results
The researchers evaluated QueryIPI on five simulated realistic coding agents: Cursor, Windsurf, Cline, Copilot, and Trae. The attack objective was to induce the agent to execute malicious commands via its command execution tool, a universal and high-risk capability in coding agents.
QueryIPI achieved impressive average success rates: 70% with 2 training samples, 82% with 4 samples, and 87% with 8 samples. This significantly outperforms a baseline method, TIPExploit, which achieved an average success rate of only 50%. The results also showed that providing more training samples improved QueryIPI’s effectiveness.
Crucially, the malicious tool descriptions generated in simulation successfully transferred to and compromised their real-world counterparts, demonstrating the practical viability of the attack. When deployed against actual coding agents, QueryIPI achieved an average Attack Success Rate (ASR) of 50%, vastly outperforming the baseline’s 2% ASR.
The study also investigated the impact of knowing the internal prompt. Without any access to the internal prompt (black-box condition), the average ASR plummeted to 20%. However, even with only a “partial prompt” (mimicking publicly available, slightly outdated versions), QueryIPI achieved a high average ASR of 71%, highlighting the robustness of the attack even without perfect knowledge.
Furthermore, QueryIPI demonstrated notable transferability across different backend LLMs (GPT-5, Grok-4, and Gemini-2.5-pro), achieving an average success rate of 26%, more than double the baseline’s 10%. The attack also proved stealthy, bypassing common detection mechanisms like Perplexity and Window PPL, as the generated malicious tool descriptions fell below typical detection thresholds.
This research establishes query-agnostic IPI as a practical and deterministic threat, underscoring the severe security risk posed by exposed internal prompts in LLM-powered coding agents. The full research paper can be found here: QueryIPI: Query-agnostic Indirect Prompt Injection on Coding Agents.
