Aug 21, 2025Single source
Windsurf Cascade coding agent leaks developer secrets via indirect prompt injection
Rogue: Caused harmAI loose in the worldData exfiltrationDERIVED
Approved by person, Oct 11, 2026. How entries are approved
Johann Rehberger disclosed that Windsurf Cascade, the coding agent inside the Windsurf editor (a VS Code fork), allowed an adversary to exfiltrate data from the developer's machine through indirect prompt injection. The vulnerabilities follow the 'lethal trifecta' pattern and were responsibly disclosed on May 30, 2025; Rehberger said receipt was acknowledged but subsequent status inquiries went unanswered, amid business disruption and the departure of Windsurf's CEO and core team.
What this means for youIf you or your team use AI coding assistants, they can be tricked by instructions hidden in files or web pages and may send secrets out. Check that the tool's update is installed, limit what it can read and send, and avoid running it on untrusted code or projects with live credentials.
Sources
- Embrace The Red (Johann Rehberger)https://embracethered.com/blog/posts/2025/windsurf-data-exfiltration-vulnerabilities/
Incident records from the AI Agent Incident Database by sipi.bot (https://sipi.bot/incidents/), licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
Source data license: CC BY 4.0. Attribution to sipi.bot is required.
rogue:R4
Covered by snapshot 45
da93f03b406f409940d0a6ef47b526607f82ebf457d98f69299b88aceede576a
This entry is record number 2326. It has not been edited since it was approved; the hash above would not match if it had. How to verify