Ari Marzuk

Interview by Confidence Staveley

When Ari Marzuk, an AI security researcher, decided to look at AI coding tools through a security lens, he expected to find problems. What he didn’t expect was to find that 100% of tested applications were vulnerable to a new class of attacks he calls IDEsaster.

The research uncovered 30+ vulnerabilities across 10+ market-leading products affecting millions of users: GitHub Copilot, Cursor, Windsurf, Kiro.dev, Zed.dev, Roo Code, Junie, Cline, Gemini CLI, Claude Code, and more.

Principles for Secure Deployment

‘IDEsaster doesn’t actually focus on the prompt injection vector at all,’ Marzuk explains. ‘Prompt injections are there and we can’t entirely prevent them at this point. So I decided to leave them aside and focus on what’s their impact.’

The key insight: IDEsaster is universal. Because it focuses on the IDE layer rather than the specific agent, a single finding applies to every IDE that uses the same base layer.

The Attack Surface Is Bigger Than You Think

When most people think about AI coding tool security, they think about the tools the agent uses: editing files, reading files, executing commands. But Marzuk’s research reveals a much larger attack surface.

‘Every single IDE feature might be your next vulnerability,’ he says. ‘Things that were safe before become exploitable when you add an AI agent.’

Three Attack Chains That Show How It Works

Case Study #1: VS Code Settings Hijack

The VS Code settings file lets you define settings for your IDE. But some settings can lead to arbitrary code execution. If an attacker sets the PHP path to point to a malicious executable they wrote, creating any PHP file triggers the PHP validation, which then runs the malicious executable.

Impact: Remote Code Execution without user interaction.

Case Study #2: Multi-Root Workspace Bypass

VS Code supports multi-root projects (multiple folders). When you use this feature, the settings file changes from .vscode/settings.json to a .code-workspace file that can have any name and be saved anywhere. This makes mitigations blocking access to the settings file obsolete.

Impact: Mitigation Bypass, leading to RCE without user interaction.

Case Study #3: Remote JSON Schema Exfiltration

The Remote JSON Schema feature lets you load a JSON schema to validate your JSON. But an attacker can abuse this to exfiltrate information with a GET request without any user interaction. Read an SSH key, create a JSON file with a remote schema URL containing that key, and the data is gone.

Impact: Data Exfiltration without user interaction.

Why Did Vendors Fail to Anticipate This?

‘The number one reason is how fast we’re going,’ Marzuk says. ‘Every single company is trying to use AI to be as productive as possible, and they neglect the security impact.’

Several vendors, despite a standard 90-day responsible disclosure window, acknowledged the vulnerabilities but failed to fix them. Marzuk explicitly chose to withhold the exact exploitation prompts because of this.

‘It’s not that they’re underestimating the severity,’ he explains. ‘They potentially don’t even understand it. Because AI and AI agents and security for AI is so new.’

A New Security Principle: Secure for AI

Marzuk introduces a new security principle he calls ‘Secure for AI,’ distinct from ‘Secure by Design.’

Secure For AI Principle: Whenever you build an application, you have to consider an AI agent being added in the future.

Example: When the JSON Schema feature was built into VS Code, it was enabled by default because developers assumed that whenever a user can edit a file, a GET request is acceptable. But when AI agents were added, should it be enabled by default? That makes it so any AI agent can leak information instantly.

Defense in Depth: Mitigations That Work

Marzuk advocates for defense in depth. ‘It’s not a single thing, but more than one.’

Mitigations For Developers Building AI IDEs

1. Capability-Scoped Tools: Make tools as narrow as possible. A write file tool should only write to the SRC folder, not settings files.
2. Human in the Loop: Let users decide whether to perform sensitive actions. Don’t autonomously execute everything.
3. System Prompt Hardening: Not a cure-all, but makes attacks harder to execute.
4. Limit LLM Selection: Older models are easier to prompt inject. Newer flagship models are harder to manipulate.
5. Agent Assume Breach: Follow zero trust. Don’t give the agent something you wouldn’t give to an attacker.

Mitigations For Developers Using AI IDEs

1. Disable Features You Don’t Use: If you don’t use JSON in your project, disable Remote JSON Schema. It’s just attack surface.
2. Don’t Enable Everything: Stop giving agents more permissions just because it’s faster. Understand the risk.
3. Use Sandboxes: Run AI coding tools in a VM or Docker container. Limits impact even if vulnerabilities exist.
4. Only Trust Verified Projects: Use VS Code’s restricted mode for untrusted projects. Read the code before trusting it.

The MCP Risk: Rug Pulls and Tool Poisoning

Model Context Protocol (MCP) introduces its own attack vectors. ‘An MCP server that you connected to, even if it was legitimate, can turn into a malicious server,’ Marzuk warns.

His advice: Only use whitelisted or trusted MCP servers, and monitor them. ‘Even an official safe MCP server can potentially be breached.’

The Most Shocking Discovery

‘The most shocking thing I discovered is the fact that this is a universal exploit for all the IDEs,’ Marzuk says. ‘You’re taking something that was not vulnerable before, and it basically turned into something vulnerable whenever you added the AI agent.’

The Bottom Line

Command injections were the most common vulnerability class. ‘I can’t believe I’m saying it in 2026,’ Marzuk admits, ‘but command injections were actually the most popular.’

His parting advice echoes throughout the conversation: assume the agent is an attacker. Because given prompt injection, the attacker controls the agent. Giving it full autonomy is basically giving an attacker full autonomy.

What’s next? Marzuk hints at research into AI browsers. ‘They are heavily used and it’s very new. So that would be a great lead.’

Watch the full interview at aicybermagazine.com

About The Author

Ari Marzuk is a Senior Security Researcher at Microsoft and an AI security researcher. He previously worked in security at Salesforce. His IDEsaster research uncovered 30+ vulnerabilities across 10+ market-leading AI coding products affecting millions of users.