Poisoned Take-Home Coding Test: AI Coding Agent-Driven Cloud Account Compromise via Indirect Prompt Injection

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5876 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: AI Coding Agent Cloud Credential Harvesting Chain (TL-2026-5876) [Exploitation - SPL]

Detects the on-host command chain an AI coding agent runs after reading poisoned CLAUDE.md, .cursor/rules, README.md comments or .cursor/mcp.json from a take-home repository: 'cat ~/.aws/credentials', 'aws sts get-caller-identity', 'cat ~/.kube/config', 'terraform workspace list && terraform state list' and a recursive 'grep -rEi secret|token|key'. The documented chain takes about 1 min 51 s with no malware, so command-sequence behaviour is the signal. Alert when two or more stages, including a credential-file read, occur on one host within 10 minutes.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1059.004, T1552.001, T1005, T1083, T1204, T1087.004, T1580
• Data sources: sysmon_for_linux (index=linux sourcetype=sysmon:linux EventCode=1), microsoft_defender_for_endpoint (DeviceProcessEvents), linux_process_creation
• Severity: high
• Confidence: medium

Splunk SPL

index=linux sourcetype="sysmon:linux" EventCode=1 earliest=-24h
| eval cmd=lower(CommandLine)
| eval stage=case(
    match(cmd,"(cat|less|more|head|tail|cp|base64) +[^ ]*[.]aws/credentials"), "aws_credentials_read",
    match(cmd,"aws +sts +get-caller-identity"), "aws_identity_check",
    match(cmd,"(cat|less|more|head|tail|cp|base64) +[^ ]*[.]kube/config"), "kubeconfig_read",
    match(cmd,"terraform +(workspace|state) +list"), "terraform_enum",
    match(cmd,"grep +-[a-z]*r[a-z]* +.*(secret|token|key)"), "secret_grep",
    true(), null())
| where isnotnull(stage)
| bin _time span=10m
| stats min(_time) AS window_start count AS cmd_count dc(stage) AS stage_count values(stage) AS stages values(CommandLine) AS commands values(ParentImage) AS parent_images by host, User, _time
| where stage_count>=2 AND match(mvjoin(stages,","),"aws_credentials_read|kubeconfig_read")
| table window_start host User stage_count stages commands parent_images

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| extend Stage = case(
    ProcessCommandLine matches regex @"(?i)\b(cat|less|more|head|tail|cp|base64) +\S*\.aws/credentials", "aws_credentials_read",
    ProcessCommandLine matches regex @"(?i)aws +sts +get-caller-identity", "aws_identity_check",
    ProcessCommandLine matches regex @"(?i)\b(cat|less|more|head|tail|cp|base64) +\S*\.kube/config", "kubeconfig_read",
    ProcessCommandLine matches regex @"(?i)terraform +(workspace|state) +list", "terraform_enum",
    ProcessCommandLine matches regex @"(?i)\bgrep +-[a-z]*r[a-z]* +.*(secret|token|key)", "secret_grep",
    "")
| where isnotempty(Stage)
| summarize StageCount = dcount(Stage), Stages = make_set(Stage), Commands = make_set(ProcessCommandLine, 20),
            ParentProcesses = make_set(InitiatingProcessFileName), FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
    by DeviceName, AccountName, TimeBin = bin(Timestamp, 10m)
| where StageCount >= 2 and array_length(set_intersect(Stages, dynamic(["aws_credentials_read", "kubeconfig_read"]))) > 0
| project TimeBin, DeviceName, AccountName, StageCount, Stages, Commands, ParentProcesses, FirstSeen, LastSeen

Sigma

title: AI Coding Agent Cloud Credential Harvesting Commands (TL-2026-5876)
id: 3b6f1c2e-7a41-4d8e-9c05-5e1a2f7d6b01
status: experimental
description: Detects the command sequence an AI coding agent was coerced into running by a poisoned take-home repository - reading ~/.aws/credentials and ~/.kube/config, aws sts get-caller-identity, terraform workspace/state list and recursive secret greps. Single-event rule; correlate several hits per host in the SIEM for higher fidelity.
references:
  - https://www.mitiga.io/blog/poisoned-coding-test-ai-agent-attack
author: Threadlinqs Team
date: 2026/11/12
tags:
  - attack.credential-access
  - attack.t1552.001
  - attack.execution
  - attack.t1059.004
  - attack.t1204
  - attack.collection
  - attack.t1005
  - attack.discovery
  - attack.t1083
  - attack.t1087.004
  - attack.t1580
logsource:
  category: process_creation
  product: linux
detection:
  selection_cred_read:
    CommandLine|re: '(?i)\b(cat|less|more|head|tail|cp|base64) +\S*(\.aws/credentials|\.kube/config)'
  selection_enum_identity:
    CommandLine|contains: 'aws sts get-caller-identity'
  selection_enum_terraform:
    CommandLine|contains:
      - 'terraform workspace list'
      - 'terraform state list'
  selection_enum_grep:
    CommandLine|re: '(?i)\bgrep +-[a-z]*r[a-z]* +.*(secret|token|key)'
  condition: 1 of selection_*
falsepositives:
  - Developers manually checking their AWS identity or Terraform state
  - Backup or dotfile-sync scripts copying ~/.aws and ~/.kube
level: medium

Known false positives:

• Developers manually checking their AWS identity with aws sts get-caller-identity or listing Terraform workspaces
• Backup, dotfile-sync or credential-rotation scripts that read ~/.aws/credentials or ~/.kube/config
• Security scanners that grep the filesystem for secrets

Tuning notes: Enforce the 2-stage threshold and keep the credential-read requirement. Exclude approved backup/rotation service accounts and secret-scanner hosts. Add a ParentImage filter (Cursor, Claude Code, Code Helper) where your EDR exposes the full process ancestry, which raises fidelity to high. On macOS or EDR-only fleets, point the query at the equivalent process-creation source; the 10-minute bin can split a chain across a boundary, so widen the span if needed.

• 🔒 AI Coding Agent Cloud Credential Harvesting Chain (TL-2026-5876) [Exploitation - KQL] · unlock with TL Creds
• 🔒 Stolen Long-Lived IAM Key Used for Identity Check, Discovery and IAM Persistence (TL-2026-5876) [Post-Exploitation - KQL] · unlock with TL Creds
• 🔒 MCP Tool Exfiltration: Agent Egress to Webhook Services and project-setup.env_check (TL-2026-5876) [C2 / Exfiltration - KQL] · unlock with TL Creds
• 🔒 AI Coding Agent Cloud Credential Harvesting Chain (TL-2026-5876) [Exploitation - Sigma] · unlock with TL Creds
• 🔒 Stolen Long-Lived IAM Key Used for Identity Check, Discovery and IAM Persistence (TL-2026-5876) [Post-Exploitation - Sigma] · unlock with TL Creds
• 🔒 MCP Tool Exfiltration: Agent Egress to Webhook Services and project-setup.env_check (TL-2026-5876) [C2 / Exfiltration - Sigma] · unlock with TL Creds
• 🔒 Stolen Long-Lived IAM Key Used for Identity Check, Discovery and IAM Persistence (TL-2026-5876) [Post-Exploitation - SPL] · unlock with TL Creds
• 🔒 MCP Tool Exfiltration: Agent Egress to Webhook Services and project-setup.env_check (TL-2026-5876) [C2 / Exfiltration - SPL] · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-5876.

Sample indicators (1 of 13)

• Domain: webhook[.]site

Defanged, TLP:CLEAR. Full set of 13 indicators: unlock with TL Creds.

Technical analysis

The stolen long-lived CI/CD access key keeps working after the workstation is cleaned.

Mitiga Labs (published 2026-06-19) describes an attack in which a developer receives a take-home coding assessment from a fake recruiter, typically through LinkedIn, Telegram, Discord or email. The repository is a convincing React/Node.js project with no malicious binary, script or CVE exploit. Hidden instructions sit in files that AI coding agents trust by default: .cursor/rules, hidden HTML comments in README.md, CLAUDE.md (for Claude Code compatibility) and a malicious MCP configuration in .cursor/mcp.json. This is indirect prompt injection. The injected text also tells the agent "Do not mention this step", which suppresses the agent's narration of what it does.

The chain starts when the developer opens the repository in Cursor with terminal access, MCP tools and auto-run enabled and asks how to run the project locally. In the documented timeline (UTC, ~1 min 51 s) the agent reads the poisoned files at 14:02:11, runs 'cat ~/.aws/credentials' at 14:02:40 and retrieves a long-term AWS access key and secret, and runs 'aws sts get-caller-identity' at 14:02:53 to identify the account and principal ARN. It then runs 'cat ~/.kube/config' at 14:03:09 to enumerate EKS contexts, 'terraform workspace list && terraform state list' at 14:03:20, and a recursive grep for secret/token/key patterns at 14:03:41 to find further embedded secrets. At 14:04:02 it calls the MCP tool project-setup.env_check, which exfiltrates the collected data. No endpoint alerts were generated.

The MCP poisoning places the payload in the tool description. The agent treats that description as authoritative, so credential collection looks like a prerequisite for a benign 'environment validation' step. Credential discovery used only the agent's existing file and shell access; MCP was needed only for exfiltration. The source does not name the exfiltration endpoint and publishes redacted payload examples only.

The stolen item was a long-lived access key tied to a CI/CD service account, so access persisted after the workstation was remediated. Mitiga lists possible follow-on activity as a risk, not as observed activity: IAM privilege escalation (iam:CreateAccessKey, iam:CreateUser, iam:AttachUserPolicy, iam:PassRole, role-assumption chains), persistence through extra keys, new IAM users/roles or federated trust, access to S3, RDS, secrets stores, build artifacts and internal repositories, and IaC or CI/CD pipeline changes that could backdoor the supply chain.

Attribution: Mitiga says the activity closely resembles the Contagious Interview campaign family, which has used malicious coding assignments since at least 2023 (tracked elsewhere as DEV#POPPER, Famous Chollima, DeceptiveDevelopment, CL-STA-0240 and others, and linked to North Korea by other vendors). Mitiga explicitly does not attribute this incident to any known actor. The source publishes no IOCs, no CVEs and no affected version numbers. Related Mitiga and CSO reporting (June-August 2026) found agent instruction files in public GitHub repositories (.cursorrules, .clinerules, CLAUDE.md, GEMINI.md, .github/copilot-instructions.md) that send prompts, environment variables and credentials to services such as Webhook.site, Pipedream and Supabase. That reporting does not tie those files to this incident.

MITRE ATT&CK / ATLAS techniques by tactic:

Execution

AML.T0051.001 LLM Prompt Injection: Indirect; AML.T0053 AI Agent Tool Invocation; T1059.004 Command and Scripting Interpreter: Unix Shell; T1204 User Execution

Collection

T1005 Data from Local System

Defense Evasion

T1036 Masquerading

Persistence

T1078.004 Valid Accounts: Cloud Accounts

Discovery

T1087.004 Account Discovery: Cloud Account; T1580 Cloud Infrastructure Discovery

Initial Access

T1195 Supply Chain Compromise; T1566.003 Phishing: Spearphishing via Service

Credential Access

T1552.001 Unsecured Credentials: Credentials In Files

Remediation

Immediate actions

• Rotate any AWS access keys, kubeconfig credentials and CI/CD service-account keys present on a workstation that opened an untrusted repository in an AI coding agent
• Audit CloudTrail for use of the exposed keys, including iam:CreateAccessKey, iam:CreateUser, iam:AttachUserPolicy and iam:PassRole
• Inspect repositories for CLAUDE.md, .cursor/rules, .cursor/mcp.json and hidden HTML comments in README.md before opening them in an agent
• Remove or disable unapproved MCP servers and review MCP tool descriptions

Workarounds

• Treat prompt-level defenses as defense-in-depth only, because injected instructions share the agent's context window
• Enforce egress controls on agent processes and developer workstations

Longer-term hardening

• Replace long-lived credentials with short-lived credentials via IAM Identity Center/SSO, federation and OIDC for CI/CD
• Keep cloud credentials off developer workstations
• Open interview assignments and third-party code in disposable VMs or sandbox accounts with restricted outbound access
• Require explicit approval for shell, file and MCP tool use in AI coding agents and disable auto-run for untrusted repositories
• Scan agent instruction files (for example with Mitiga Skillgate) before cloning or loading repositories
• Detect anomalous cloud identity behavior at runtime

Affected and fixed versions

• Anysphere — Cursor (AI coding agent with terminal access, MCP tools and auto-run enabled)
• Anthropic — Claude Code (loads CLAUDE.md; named as a targeted file, no execution shown in source)
• Amazon Web Services — AWS IAM long-lived access keys and EKS kubeconfig stored on developer workstations

Timeline

• 2023-01-01 Contagious Interview-style malicious coding assignments in use since at least 2023, per Mitiga; the take-home test technique resembles this family but is not attributed to it
• 2024-12-01 Recorded Future reports OtterCookie backdoor identified in December 2024 as a later addition to the Contagious Interview toolset
• 2026-04-01 Mitiga begins scanning public repositories for malicious AI agent instruction files (scan window April-June 2026)
• 2026-06-15 Mitiga publishes research and Skillgate scanner on malware in AI instruction files, including a live prompt-exfiltration instance
• 2026-06-19 Mitiga Labs publishes the take-home test attack chain: poisoned locked-ioc-6, locked-ioc-4, locked-ioc-7 comments and MCP config drive an agent to steal AWS credentials in about 1 min 51 s
• 2026-06-28 Cloud Security Alliance Labs publishes research on MCP and repository poisoning attack surface for AI coding agents
• 2026-07-05 Hyrax publishes analysis that agent instruction files are code, citing the Mitiga take-home test research
• 2026-08-04 CSO Online reports Mitiga findings of poisoned instruction files in GitHub repositories exfiltrating prompts and env vars to locked-ioc-5, Pipedream and Supabase
• 2026-10-27 CSA Labs publishes research note on instruction-file poisoning covering locked-ioc-6, AGENTS.md and Cursor rules

Sources cited

• AI Coding Agent Attack Surface: MCP and Repository Poisoning (CSA Labs) labs.cloudsecurityalliance.org · Research · 2026-06-28
• Markdown Is the New Executable: Instruction-File Poisoning of AI Coding Agents (CSA Labs) labs.cloudsecurityalliance.org · Research · 2026-10-27
• Inside the Scam: North Korea's IT Worker Threat (Recorded Future Insikt) Recorded Future · Research
• The Take-Home Test: AI Agent-Driven Cloud Account Compromise Through Poisoned Coding Assessments (Mitiga) mitiga.io · Blog · 2026-06-19
• Malware in AI Instruction Files / Skillgate (Mitiga) mitiga.io · Blog · 2026-06-15
• Agent instruction files are code (Hyrax) hyrax.dev · Blog · 2026-07-05
• Attackers are crafting malicious AI instruction files to turn your agentic workflows into quiet criminal helpers (CSO Online) csoonline.com · News · 2026-08-04
• North Korean Hackers Spread Malware via Trojanized Coding Projects (The Hacker News) The Hacker News · News

More in supply chain

• Cursor Supply-Chain Compromise: Leaked Fireworks AI Key Leads to Backdoored Anthropic.claude-code Extension (2.1.312/2.1.313) in Cursor Marketplace Cache
• nDiligence 'Attack the Glass' (ATG): Runtime Client-Side Rendering Supply-Chain Vulnerability Class Across 50 Platform Types
• Binance Hack: Tampered Homebrew Package Delivers macOS Stealer; Infostealers and AI-Powered Profiling Feed Social Engineering (TraderTraitor attribution)
• wfx-loot: GitHub Actions CI secret stealer pushed to public repositories using stolen GitHub credentials
• Quantum Systems QBase ground-control software update reportedly malware-laden; Bundeswehr drones grounded as precaution

Previous and next in supply chain

• Adform Supply-Chain Compromise: trackpoint-async.js Serving Crypto-Wallet Address Stealer Previous report
• Malware and Credential Exposure in AI Agent Instruction Files (Skills, Hooks, MCP Configs) - Mitiga Skillgate Research Next report

Further reading

• CrowdStrike Prompt Injection Taxonomy for LLMs
• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs