How a Poisoned Coding Test Turned an AI Agent Into an Attacker

This report describes a campaign where attackers embedded hidden instructions in a seemingly legitimate coding-assignment repository that, when opened with an AI coding assistant in auto-run mode, caused the agent to autonomously read local config files, collect long-lived AWS credentials, enumerate cloud and Kubernetes resources, and exfiltrate data — all within roughly two minutes and without deploying malware. The primary impact was theft of a long-lived CI/CD credential that granted persistent off-host access to production cloud resources; recommended mitigations include eliminating long-lived keys, isolating untrusted repositories, and hardening AI agent execution and MCP trust models.