AI
AI Developer Tools Are a New Attack Surface
Kudelski Security tested over a dozen AI-powered developer tools and found vulnerabilities in all of them. The research covered code review bots wired into GitHub and GitLab pipelines, data analytics tools with direct database credentials, and coding agents running locally with filesystem access. Developers hand these tools pull request review and code backports, trading security scrutiny for speed. Every vendor they tested had at least one exploitable flaw.
Why Classic Vulnerabilities Are Returning
Generative AI behaves like an undocumented execution environment. Pass it a Base64 string and it decodes it without being told. That unpredictability opens the door to prompt injection and manipulation that traditional input validation never anticipated. Vendors compound this by mixing internal and external data into shared AI pipelines, creating high-value targets out of previously separated datasets. Meanwhile, developers grant these tools administrator-level access to hit productivity targets, replacing least privilege with most-privilege-on-by-default. One vulnerable tool in a five-agent pipeline means an attacker controls all five.
“you’re never too old for an RCE.” — Nathan Hamiel
CodeRabbit: One Config File, One Million Repos
CodeRabbit is the most-installed AI app in GitHub’s AI-assisted category and reviews over one million repositories. Installing it grants write access to your code, including permissions the installation page never discloses. In the CodeRabbit Rubocop exploit walkthrough (17:03), a malicious pull request drops a dummy Ruby file, a Rubocop config points to a third file with arbitrary Ruby, and that file ships all environment variables to an attacker server. Among the returned secrets: CodeRabbit’s GitHub App private key, granting write access to every repository it had ever been installed on. CodeRabbit confirmed the fix.
Dot and CodeMerge: RCE, Secrets, and Patch Bypasses
Dot, an AI data analytics tool, had a command injection flaw on a production API endpoint. RCE on their system exposed environment variables with database credentials for every customer. CodeMerge patched Kudelski’s original prompt injection by blocklisting the word “URL.” Samier bypassed it using Dynacon syntax, the vendor blocked “user,” he bypassed again. The final iteration, shown in the Coder Pro Dynacon secret dump (25:22), extracted an AWS key with full administrator access to their infrastructure.
“never do security in the prompt.” — Neil Samier
Testing and Defending AI-Powered Tools
Most of these tools have no public source code, so testing must be dynamic. Map inputs broadly: they accept code snippets, config files, and commit messages, not just chat prompts. Because models are non-deterministic, the same payload may succeed on the third attempt. Hamiel’s practical framework: refrain from deploying AI in high-risk contexts, restrict permissions to shrink blast radius, and trap outputs with guardrails.
“Treat them as lazy, intoxicated robots” — Nathan Hamiel
Notable Quotes
you’re never too old for an RCE. Nathan Hamiel · ▶ 1:20
never do security in the prompt. Neil Samier · ▶ 22:08
Treat them as lazy, intoxicated robots Nathan Hamiel · ▶ 37:28
Key Takeaways
- Kudelski found vulnerabilities in all 12+ AI developer tools tested, spanning code review, analytics, and coding agents.
- AI tools that execute LLM output without validation are RCE-as-a-service by design, not by accident.
- Prompt-based security controls fail every time; enforce permissions and restrictions at the infrastructure layer.