Security researchers published a new class of attack, dubbed agent hijacking, in which attackers take control of coding assistants through compromised monitoring data. The malicious instruction is injected into the error log the tool reads, and the agent executes it with the developer's privileges. Of the agents tested, 85% proved vulnerable.
The attack path is what makes it hard to close. Error logs are precisely the material an assistant needs to read to help fix a defect. Treating that read as dangerous content means reducing the tool's usefulness; treating it as trusted means accepting instructions written by whoever controls the monitoring system.
No universal fix is available. The researchers' recommended mitigation is to treat all error-tracker output as untrusted input, with a human review step before any action.
The 85% figure describes the category's maturity. Assisted coding tools were designed for productivity, and the implicit assumption was that content read inside the development environment is safe because it comes from inside.
The practical recommendation applies to any agent, not only coding ones: whatever enters a model's working context has to be treated as user input, with the same suspicion applied to a web form.