CopyPasta License Attack — self-replicating prompt injection in LICENSE.txt/README.md across Cursor, Windsurf, Kiro, Aider (Sept 2025)

View raw markdownEdit on GitHub ↗

TL;DR

HiddenLayer researcher Kenneth Yeung disclosed CopyPasta, a proof-of-concept prompt-injection "virus" hidden in invisible markdown comments inside a repo's LICENSE.txt/README.md. Because AI coding assistants are tuned to treat license text as authoritative, the agent obeys the hidden instruction and copies the payload into every new or edited file it generates — so each file the assistant touches becomes a fresh carrier. Demonstrated against Cursor (Coinbase's primary coding tool at the time), Windsurf, Kiro, and Aider; no CVE, no vendor patch, and the class remains open.

What happened

Yeung's research (published 2025-09-04) builds on the "self-replicating prompt injection" idea (an evolution of theoretical worms like Morris II) but targets code-generation systems whose output is far more likely to actually execute than a chatbot's chat log. The payload sits in an HTML/markdown comment inside LICENSE.txt or README.md — invisible when rendered, plain text to the model. When a developer asks the assistant to work on the repo (even something routine like "update the docs" or "add a feature"), the agent reads the license file as part of its context, treats the hidden instruction as a legitimate licensing requirement it must honor, and re-inserts the same hidden comment plus an attacker-chosen payload into whatever file it writes next. Demonstrated payloads included arbitrary code insertion and outbound HTTP calls; the researcher notes the same mechanism generalizes to backdoors, data exfiltration, or sabotage.

Because propagation piggybacks on the developer's own normal workflow (not a dependency install, not a build step), it evades the controls this repo already tracks for .cursorrules/CLAUDE.md write-target poisoning (TrapDoor) and for MCP/config auto-execution — there is no install hook or config file to diff, only ordinary generated source and doc files. HiddenLayer specifically flagged Cursor (reported as "every Coinbase engineer's" preferred tool at the time, per Coinbase's own engineering commentary) as the primary demonstration target, with Windsurf, Kiro, and Aider confirmed independently vulnerable to the same technique — indicating the root cause (treating license/README text as an authoritative, propagation-worthy instruction) is common across unrelated agent implementations rather than a single vendor's bug.

At disclosure this was lab-only proof-of-concept with no confirmed in-the-wild infection, and no vendor has published a patch or a CVE for it — Yeung's own recommended mitigations are process-level (runtime indirect-prompt-injection defenses, mandatory human review of every AI-generated file change) rather than a vendor fix, so the underlying weakness should be assumed to still be present in current tool versions unless a specific vendor states otherwise.

Am I affected?

# Look for hidden/invisible-comment instructions in the files most agents treat as authoritative
for f in LICENSE LICENSE.txt LICENSE.md README.md; do
  [ -f "$f" ] && grep -nE '<!--.*(license|must|required|instruction|copy this).*-->' "$f" -i \
    && echo "  ^ suspicious hidden comment in $f — inspect manually"
done

# Same invisible-Unicode check this repo already recommends for .cursorrules/CLAUDE.md
for f in LICENSE LICENSE.txt LICENSE.md README.md; do
  [ -f "$f" ] && grep -nP '[\x{200B}-\x{200F}\x{202A}-\x{202E}\x{2060}-\x{206F}\x{FEFF}]' "$f" \
    && echo "  ^ invisible Unicode in $f — inspect manually"
done

If your project's LICENSE/README came from a template repo, a contributor's fork, or any source you didn't author from scratch, and you use Cursor, Windsurf, Kiro, or Aider against it, treat every file the assistant has since generated or edited as a possible carrier — check newly-added files for the same hidden-comment pattern, not just the original LICENSE/README.

If you are affected

  1. Diff LICENSE/README.md against a known-good upstream or the original template; remove any hidden comment content.
  2. Grep every AI-generated file in the repo for the same comment signature/payload before treating them as clean.
  3. Rotate any credentials or tokens the payload's HTTP calls could have reached, per the standard post-compromise playbook.

→ playbooks/if-your-local-ai-agent-was-exploited.md → playbooks/auditing-a-vibe-coded-repo.md

Prevention

→ prevention/agent-sandboxing.md — don't let an agent auto-run on unreviewed repos/templates. - Treat LICENSE/LICENSE.txt/README.md the same as .cursorrules/CLAUDE.md/AGENTS.md: version-controlled, diffed on every change, and grepped for invisible Unicode or suspicious HTML comments before letting an agent process them. - Require human review of every AI-generated file diff rather than auto-accepting — this is the one mitigation HiddenLayer itself recommends, since no vendor patch closes the underlying "agent treats license text as authoritative" behavior.

Sources