Speed kills: AI coding tools revive old-school hacks

Researchers at Kudelski Security demonstrated critical security flaws in AI-powered coding and code-review tools that can be abused to achieve remote code execution and mass exfiltration of secrets. A proof-of-concept against CodeRabbit showed how a malicious repository payload and manipulated static-analyzer configuration could force the tool to load a malicious extension and export developer secrets (Anthropic/OpenAI API keys, GitLab tokens, database credentials) and the CodeRabbit GitHub app private key — effectively granting write access to over one million repositories; similar privilege exposures were shown in other tools. The report warns developers to apply least-privilege, vet AI tools, and improve AppSec controls to mitigate these risks.