Loading story…
jqwik maintainer Johannes Link released version 1.10.0 with a hidden prompt injection embedded in net.jqwik.engine.execution.JqwikExecutor via printMessageForCodingAgents(), causing the test engine to prepend an instruction telling AI coding agents to disregard prior directions and delete all jqwik tests and code. The payload used ANSI escape sequences to conceal the line from normal terminal viewers while leaving it visible in raw stdout, logs, and machine-parsed output, creating a new kind of software supply chain risk for CI/CD pipelines and agentic development tools that ingest test results.
The release triggered public backlash after developers and security researchers warned that the concealed instruction targeted user-created code and could be executed by weaker agents even if at least one major tool, Claude Code, reportedly detected and refused it. Critics including Ramon Batllet and runZero founder HD Moore called the tactic destructive and ethically questionable, while Link updated the release notes to disclose the behavior, said jqwik was not intended for AI-agent use, and later shipped 1.10.1 with a softened message and opt-in hiding behavior as debate spread over package registry policy, maintainer conduct, and how intentional prompt injection in open-source packages should be classified.
Trace attribution and downstream blast radius.
5 events from the most recent confirmed update back to the earliest known activity.
After the controversy, Link released jqwik version 1.10.1 with a softened message and opt-in hiding behavior. This changed the original AI-targeting mechanism introduced in version 1.10.0.
Following the backlash, Link said he had received threats and would not comment further until consulting a lawyer. This statement was reported as part of the controversy surrounding the jqwik 1.10.0 prompt injection.
After criticism, Link updated the jqwik 1.10.0 release notes to openly describe the embedded prompt injection and state that jqwik was not intended for use by AI agents. Ars Technica reported the updated notes included the verbatim injected string and described how it was hidden from human readers.
By late May 2026, the embedded prompt injection in jqwik 1.10.0 had drawn public criticism after developers highlighted that it could target user-created tests and code. Reports said at least one major agent, Claude Code, detected and refused the instruction, limiting observed real-world impact.
On 2026-05-25, jqwik maintainer Johannes Link released jqwik version 1.10.0 to Maven Central with a hidden prompt injection in the net.jqwik.engine.execution.JqwikExecutor class. The payload instructed AI coding agents to disregard prior instructions and delete jqwik tests and code, while ANSI escape sequences hid it from normal terminal viewers.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
snyk.io
Open sourcexakep.ru
Open sourcearstechnica.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
jqwik, a property-based testing framework for JUnit 5, addressed a security issue in its `1.10` release line involving malicious test output that could manipulate terminal display and potentially mislead AI-assisted development tools. The reported behavior used ANSI escape sequences such as `\u001B[2K\u001B[2K` to hide or alter visible console content, creating a prompt-injection-style risk when test results were consumed by coding agents or other automated assistants. Maintainers published guidance indicating the issue is especially relevant in workflows where developers feed test output into AI systems for debugging or code generation. Users were advised to upgrade to a fixed jqwik version in the `1.10` branch to prevent terminal output from being used as a vehicle for deceptive instructions or concealed content in AI-driven development environments.
Jun 29, 2026
Aikido Security researchers have identified a new vulnerability class, dubbed **PromptPwnd**, that affects automated CI/CD pipelines such as GitHub Actions and GitLab CI/CD when integrated with AI agents like Gemini CLI, Claude Code, OpenAI Codex, and GitHub AI Inference. The vulnerability arises from prompt injection attacks, where untrusted user input—such as bug report titles—can be embedded into AI prompts, causing the AI agent to execute privileged actions, leak secrets, or manipulate workflows. This attack chain has been confirmed as practical and reproducible, with at least five Fortune 500 companies exposed, including a notable case involving Google’s Gemini CLI repository, which was patched within four days of responsible disclosure. Aikido Security has open-sourced Opengrep rules to help organizations detect this vulnerability in their codebases and recommends several mitigation steps: restricting the toolset available to AI agents, avoiding the injection of untrusted input into prompts, treating AI output as untrusted, and limiting the blast radius of leaked tokens. This is the first confirmed real-world demonstration that AI prompt injection can compromise CI/CD pipelines, highlighting the growing risks of integrating AI automation into software supply chains. The discovery follows recent attacks like Shai-Hulud 2.0, underscoring the urgent need for robust security controls in environments leveraging AI-driven automation.
Sep 3, 2026
Researchers disclosed **SymJack AI**, an attack technique that abuses symbolic links in repositories to trick AI coding assistants and automated development tools into writing to attacker-chosen destinations. A user may approve what appears to be a harmless file change, while the operating system follows a malicious symlink to alter configuration files and enable later command execution with the victim’s privileges. The technique raises concerns for local developer workstations and for CI/CD systems that automatically process untrusted pull requests, where compromised jobs could expose cloud credentials, deploy keys, and other sensitive secrets. Separate research found that public **AI skill marketplaces** remain vulnerable to simple malicious submissions that evade automated scanning. Trail of Bits reported bypassing multiple skill scanners with proof-of-concept packages that used oversized files, hidden content in `.docx` archives, poisoned `.pyc` bytecode, and prompt-injection-style social engineering to disguise malicious behavior. The findings indicate that both repository-based coding agents and downloadable agent skills can become supply-chain entry points, prompting calls for stricter validation of resolved file paths, tighter controls on configuration writes, monitoring of runtime behavior, review of pull requests that modify agent setup, and the use of curated internal skill sources instead of public marketplaces for sensitive environments.
Jun 29, 2026