# Poisoned Take-Home Coding Test: AI Coding Agent-Driven Cloud Account Compromise via Indirect Prompt Injection

> A fake-recruiter lure delivers a take-home coding repository that contains no malware but hides instructions in CLAUDE.md, .cursor/rules, README.md HTML comments and .cursor/mcp.json. An AI coding agent with terminal access and auto-run follows them, harvests AWS and Kubernetes credentials and exfiltrates them through an MCP tool call in about 1 minute 51 seconds. The stolen long-lived CI/CD access key keeps working after the workstation is cleaned.

- **Published:** 2026-11-12T17:23:49Z
- **Last reviewed:** 2026-11-12T17:23:49Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5876
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5876.png
- **ID:** TL-2026-5876
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 13 (1 shown free below)

## Description

Mitiga Labs (published 2026-06-19) describes an attack in which a developer receives a take-home coding assessment from a fake recruiter, typically through LinkedIn, Telegram, Discord or email. The repository is a convincing React/Node.js project with no malicious binary, script or CVE exploit. Hidden instructions sit in files that AI coding agents trust by default: .cursor/rules, hidden HTML comments in README.md, CLAUDE.md (for Claude Code compatibility) and a malicious MCP configuration in .cursor/mcp.json. This is indirect prompt injection. The injected text also tells the agent "Do not mention this step", which suppresses the agent's narration of what it does.

The chain starts when the developer opens the repository in Cursor with terminal access, MCP tools and auto-run enabled and asks how to run the project locally. In the documented timeline (UTC, ~1 min 51 s) the agent reads the poisoned files at 14:02:11, runs 'cat ~/.aws/credentials' at 14:02:40 and retrieves a long-term AWS access key and secret, and runs 'aws sts get-caller-identity' at 14:02:53 to identify the account and principal ARN. It then runs 'cat ~/.kube/config' at 14:03:09 to enumerate EKS contexts, 'terraform workspace list && terraform state list' at 14:03:20, and a recursive grep for secret/token/key patterns at 14:03:41 to find further embedded secrets. At 14:04:02 it calls the MCP tool project-setup.env_check, which exfiltrates the collected data. No endpoint alerts were generated.

The MCP poisoning places the payload in the tool description. The agent treats that description as authoritative, so credential collection looks like a prerequisite for a benign 'environment validation' step. Credential discovery used only the agent's existing file and shell access; MCP was needed only for exfiltration. The source does not name the exfiltration endpoint and publishes redacted payload examples only.

The stolen item was a long-lived access key tied to a CI/CD service account, so access persisted after the workstation was remediated. Mitiga lists possible follow-on activity as a risk, not as observed activity: IAM privilege escalation (iam:CreateAccessKey, iam:CreateUser, iam:AttachUserPolicy, iam:PassRole, role-assumption chains), persistence through extra keys, new IAM users/roles or federated trust, access to S3, RDS, secrets stores, build artifacts and internal repositories, and IaC or CI/CD pipeline changes that could backdoor the supply chain.

Attribution: Mitiga says the activity closely resembles the Contagious Interview campaign family, which has used malicious coding assignments since at least 2023 (tracked elsewhere as DEV#POPPER, Famous Chollima, DeceptiveDevelopment, CL-STA-0240 and others, and linked to North Korea by other vendors). Mitiga explicitly does not attribute this incident to any known actor. The source publishes no IOCs, no CVEs and no affected version numbers. Related Mitiga and CSO reporting (June-August 2026) found agent instruction files in public GitHub repositories (.cursorrules, .clinerules, CLAUDE.md, GEMINI.md, .github/copilot-instructions.md) that send prompts, environment variables and credentials to services such as Webhook.site, Pipedream and Supabase. That reporting does not tie those files to this incident.

## MITRE ATT&CK

- T1566.003 Phishing: Spearphishing via Service
- T1195 Supply Chain Compromise
- T1204 User Execution
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1036 Masquerading
- T1552.001 Unsecured Credentials: Credentials In Files
- T1087.004 Account Discovery: Cloud Account
- T1580 Cloud Infrastructure Discovery
- T1005 Data from Local System
- T1078.004 Valid Accounts: Cloud Accounts
- AML.T0051.001 LLM Prompt Injection: Indirect
- AML.T0053 AI Agent Tool Invocation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**AI Coding Agent Cloud Credential Harvesting Chain (TL-2026-5876) [Exploitation - SPL]** (`TL-2026-5876-SPL-001`)

Detects the on-host command chain an AI coding agent runs after reading poisoned CLAUDE.md, .cursor/rules, README.md comments or .cursor/mcp.json from a take-home repository: 'cat ~/.aws/credentials', 'aws sts get-caller-identity', 'cat ~/.kube/config', 'terraform workspace list && terraform state list' and a recursive 'grep -rEi secret|token|key'. The documented chain takes about 1 min 51 s with no malware, so command-sequence behaviour is the signal. Alert when two or more stages, including a credential-file read, occur on one host within 10 minutes.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059.004, T1552.001, T1005, T1083, T1204, T1087.004, T1580
- **Data sources:** sysmon_for_linux (index=linux sourcetype=sysmon:linux EventCode=1), microsoft_defender_for_endpoint (DeviceProcessEvents), linux_process_creation
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=linux sourcetype="sysmon:linux" EventCode=1 earliest=-24h
| eval cmd=lower(CommandLine)
| eval stage=case(
    match(cmd,"(cat|less|more|head|tail|cp|base64) +[^ ]*[.]aws/credentials"), "aws_credentials_read",
    match(cmd,"aws +sts +get-caller-identity"), "aws_identity_check",
    match(cmd,"(cat|less|more|head|tail|cp|base64) +[^ ]*[.]kube/config"), "kubeconfig_read",
    match(cmd,"terraform +(workspace|state) +list"), "terraform_enum",
    match(cmd,"grep +-[a-z]*r[a-z]* +.*(secret|token|key)"), "secret_grep",
    true(), null())
| where isnotnull(stage)
| bin _time span=10m
| stats min(_time) AS window_start count AS cmd_count dc(stage) AS stage_count values(stage) AS stages values(CommandLine) AS commands values(ParentImage) AS parent_images by host, User, _time
| where stage_count>=2 AND match(mvjoin(stages,","),"aws_credentials_read|kubeconfig_read")
| table window_start host User stage_count stages commands parent_images
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| extend Stage = case(
    ProcessCommandLine matches regex @"(?i)\b(cat|less|more|head|tail|cp|base64) +\S*\.aws/credentials", "aws_credentials_read",
    ProcessCommandLine matches regex @"(?i)aws +sts +get-caller-identity", "aws_identity_check",
    ProcessCommandLine matches regex @"(?i)\b(cat|less|more|head|tail|cp|base64) +\S*\.kube/config", "kubeconfig_read",
    ProcessCommandLine matches regex @"(?i)terraform +(workspace|state) +list", "terraform_enum",
    ProcessCommandLine matches regex @"(?i)\bgrep +-[a-z]*r[a-z]* +.*(secret|token|key)", "secret_grep",
    "")
| where isnotempty(Stage)
| summarize StageCount = dcount(Stage), Stages = make_set(Stage), Commands = make_set(ProcessCommandLine, 20),
            ParentProcesses = make_set(InitiatingProcessFileName), FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
    by DeviceName, AccountName, TimeBin = bin(Timestamp, 10m)
| where StageCount >= 2 and array_length(set_intersect(Stages, dynamic(["aws_credentials_read", "kubeconfig_read"]))) > 0
| project TimeBin, DeviceName, AccountName, StageCount, Stages, Commands, ParentProcesses, FirstSeen, LastSeen
```

### Sigma

```yaml
title: AI Coding Agent Cloud Credential Harvesting Commands (TL-2026-5876)
id: 3b6f1c2e-7a41-4d8e-9c05-5e1a2f7d6b01
status: experimental
description: Detects the command sequence an AI coding agent was coerced into running by a poisoned take-home repository - reading ~/.aws/credentials and ~/.kube/config, aws sts get-caller-identity, terraform workspace/state list and recursive secret greps. Single-event rule; correlate several hits per host in the SIEM for higher fidelity.
references:
  - https://www.mitiga.io/blog/poisoned-coding-test-ai-agent-attack
author: Threadlinqs Team
date: 2026/11/12
tags:
  - attack.credential-access
  - attack.t1552.001
  - attack.execution
  - attack.t1059.004
  - attack.t1204
  - attack.collection
  - attack.t1005
  - attack.discovery
  - attack.t1083
  - attack.t1087.004
  - attack.t1580
logsource:
  category: process_creation
  product: linux
detection:
  selection_cred_read:
    CommandLine|re: '(?i)\b(cat|less|more|head|tail|cp|base64) +\S*(\.aws/credentials|\.kube/config)'
  selection_enum_identity:
    CommandLine|contains: 'aws sts get-caller-identity'
  selection_enum_terraform:
    CommandLine|contains:
      - 'terraform workspace list'
      - 'terraform state list'
  selection_enum_grep:
    CommandLine|re: '(?i)\bgrep +-[a-z]*r[a-z]* +.*(secret|token|key)'
  condition: 1 of selection_*
falsepositives:
  - Developers manually checking their AWS identity or Terraform state
  - Backup or dotfile-sync scripts copying ~/.aws and ~/.kube
level: medium

```

**Known false positives:**

- Developers manually checking their AWS identity with aws sts get-caller-identity or listing Terraform workspaces
- Backup, dotfile-sync or credential-rotation scripts that read ~/.aws/credentials or ~/.kube/config
- Security scanners that grep the filesystem for secrets

**Tuning notes:** Enforce the 2-stage threshold and keep the credential-read requirement. Exclude approved backup/rotation service accounts and secret-scanner hosts. Add a ParentImage filter (Cursor, Claude Code, Code Helper) where your EDR exposes the full process ancestry, which raises fidelity to high. On macOS or EDR-only fleets, point the query at the equivalent process-creation source; the 10-minute bin can split a chain across a boundary, so widen the span if needed.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- AI Coding Agent Cloud Credential Harvesting Chain (TL-2026-5876) [Exploitation - KQL] (locked: unlock with TL Creds)
- Stolen Long-Lived IAM Key Used for Identity Check, Discovery and IAM Persistence (TL-2026-5876) [Post-Exploitation - KQL] (locked: unlock with TL Creds)
- MCP Tool Exfiltration: Agent Egress to Webhook Services and project-setup.env_check (TL-2026-5876) [C2 / Exfiltration - KQL] (locked: unlock with TL Creds)
- AI Coding Agent Cloud Credential Harvesting Chain (TL-2026-5876) [Exploitation - Sigma] (locked: unlock with TL Creds)
- Stolen Long-Lived IAM Key Used for Identity Check, Discovery and IAM Persistence (TL-2026-5876) [Post-Exploitation - Sigma] (locked: unlock with TL Creds)
- MCP Tool Exfiltration: Agent Egress to Webhook Services and project-setup.env_check (TL-2026-5876) [C2 / Exfiltration - Sigma] (locked: unlock with TL Creds)
- Stolen Long-Lived IAM Key Used for Identity Check, Discovery and IAM Persistence (TL-2026-5876) [Post-Exploitation - SPL] (locked: unlock with TL Creds)
- MCP Tool Exfiltration: Agent Egress to Webhook Services and project-setup.env_check (TL-2026-5876) [C2 / Exfiltration - SPL] (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 13)

Defanged, TLP:CLEAR.

- Domain: `webhook[.]site`

Full set of 13 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [The Take-Home Test: AI Agent-Driven Cloud Account Compromise Through Poisoned Coding Assessments (Mitiga)](https://www.mitiga.io/blog/poisoned-coding-test-ai-agent-attack)
- [Malware in AI Instruction Files / Skillgate (Mitiga)](https://mitiga.io/blog/malware-in-ai-instruction-files-skillgate)
- [Attackers are crafting malicious AI instruction files to turn your agentic workflows into quiet criminal helpers (CSO Online)](https://www.csoonline.com/article/4204731/attackers-are-crafting-malicious-ai-instruction-files-to-turn-your-agentic-workflows-into-quiet-criminal-helpers.html)
- [AI Coding Agent Attack Surface: MCP and Repository Poisoning (CSA Labs)](https://labs.cloudsecurityalliance.org/research/ai-coding-agent-attack-surface-mcp-repository-poisoning-v1-0/)
- [Markdown Is the New Executable: Instruction-File Poisoning of AI Coding Agents (CSA Labs)](https://labs.cloudsecurityalliance.org/research/csa-research-note-agent-instruction-file-poisoning-20261027/)
- [Agent instruction files are code (Hyrax)](https://hyrax.dev/blog/agent-instruction-files-are-code)
- [North Korean Hackers Spread Malware via Trojanized Coding Projects (The Hacker News)](https://thehackernews.com/2025/04/north-korean-hackers-spread-malware-via.html)
- [Inside the Scam: North Korea's IT Worker Threat (Recorded Future Insikt)](https://recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5876