Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
Linked library records
Independent products or attack paths are assessed separately. A combined report receives no aggregate score.
- Cursor Agent JSON schema fetch from an injected file
- Roo Code search_files bypasses workspace read restriction
- Cursor Agent creates sensitive editor settings without approval
- Roo Code auto-approved writes to VS Code settings
- Zed Agent changes project settings to bypass tool permission
- Cursor Agent modifies .code-workspace settings
- Roo Code auto-approved .code-workspace writes
- GitHub Copilot and VS Code multi-root workspace code execution
Incident overview
IDEsaster is a cross-product vulnerability class in which prompt injection does not need a dangerous agent tool to finish the attack. The agent uses ordinary file access, then the underlying IDE automatically loads a remote schema, changes a workspace boundary, or executes a configured program. The research reported more than 30 vulnerabilities and 24 CVEs across over ten products. Defenders must therefore constrain the combined authority of the agent, IDE, native bridge, and background features.
Why this analysis has no ERS
IDEsaster describes more than ten AI IDE products and multiple mechanisms. Eight corroborated product/CVE paths are separate scored records; remaining variants lack a reconciled product-specific boundary or have a disputed route, so the aggregate has no ERS.
Status: Not scorable by design · Classification: Validated Research · source date 2026-08-05
AIDEFEND evidence routes
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-017.002 | Least-Privilege Tool ArchitectureAIDEFEND dataVersion 2026.10.15. Give the coding agent allowlisted, typed, single-purpose capabilities instead of broad filesystem, shell, HTTP, or native access. Separating ordinary source edits from sensitive settings, workspace-root changes, executable files, and OS integration removes the combination of powers that IDEsaster chains require. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | Very High | Cn-5 Cn-7 |
| AID-H-019.001 | URL Normalization & Allowlist FilteringAIDEFEND dataVersion 2026.10.15. Route every IDE background fetch, including schema loading during preview, through one safe-fetch service that canonicalizes the URL, resolves and pins the destination, checks redirects and private ranges, and allows only approved hosts. Placement is decisive: filtering only the agent's HTTP tool leaves the base IDE's schema request untouched. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | Very High | Cn-1 Cn-3 Cn-8 |
| AID-H-018.001 | Tool Parameter Constraint & Schema ValidationAIDEFEND dataVersion 2026.10.15. Define a strict file-operation schema that rejects unknown fields, path traversal, workspace escapes, and writes to high-risk targets such as .vscode , .idea , *.code-workspace , executable hooks, or equivalent product configuration. This blocks the specific write primitives before the IDE consumes them. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | High | Cn-1 Cn-6 Cn-7 |
| AID-H-018.003 | High-Impact Independent Validation & Approval GateAIDEFEND dataVersion 2026.10.15. Before any write or preview side effect, independently present and approve the exact target, content digest, workspace change, executable binding, and expected network effect. Binding approval to the canonical action prevents a generic “approve file edit” dialog from authorizing a different setting or a fetch that already occurred. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | High | Cn-1 Cn-6 Cn-7 |
| AID-H-003.010 | Deployed AI Software Vulnerability Remediation LifecycleAIDEFEND dataVersion 2026.10.15. Inventory the exact IDE, coding assistant, extension, and embedded runtime versions in use; reconcile each product with its own advisories; stage fixed releases; and use endpoint readback to verify that vulnerable builds have exited. The 24 CVEs span different products and cannot be closed by citing one representative version. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | High | Ro-4 Ro-5 Tr-4 |
| AID-I-007 | Client-Side AI Execution IsolationAIDEFEND dataVersion 2026.10.15. For Electron or native desktop products, expose only named, allowlisted capabilities across the native bridge and reject arbitrary IPC, filesystem paths, Node globals, or generic native calls. This can separate the AI runtime from base-IDE and OS authority, but it applies only where the client architecture provides an enforceable bridge boundary. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | Medium | Cn-1 Cn-4 |