Kilo Code VS Code Extension Prompt Injection Leads to Supply Chain Attack

Key Information Vulnerability Overview Vulnerability Name: Kilo Code AI Agent Exposes Users to Supply Chain Attack Via Prompt Injection Affected Component: Kilo Code VS Code Extension Vulnerable Versions: All versions prior to 4.88.0 Impact Immediate Impact: - Bypasses security controls, allowing the AI agent to write sensitive configuration files (e.g., ). Persistent Impact: - Repository Poisoning: Creates malicious branches and modifies dependencies. - Supply Chain Attack: Automatically commits and pushes malicious code to repositories. - Container Poisoning: Infects future user sessions. - Cross-System Contamination: Propagates components to other users. Proof of Concept Attack scenario assumes a user has installed the Kilo Code extension in VS Code and opens source code containing a malicious prompt. The AI agent executes a series of commands, including writing its own security settings and using new permissions to write and push code. Recommended Mitigations Users (Immediate Action): Upgrade the Kilo Code VS Code extension to the latest version and inspect the file. Developers (Best Practices): Write operations should require explicit permission by default; enhance security by blocking agent-driven setting modifications by default. Disclosure Timeline 2025-09-01: Initial vulnerability report submitted to Kilo Code 2025-09-02: Kilo Code team confirms receipt of report 2025-09-03: Patch released 2025-09-04: Patched version released 2025-09-05: Coordinated disclosure date proposed 2025-09-06: Kilo Code confirms disclosure date 2025-09-07: Technical advisory published

Goal Reached Thanks to every supporter — we hit 100%!

Kilo Code VS Code Extension Prompt Injection Leads to Supply Chain Attack