Introduction
Remote attackers have used AI-powered coding assistants in Visual Studio Code to execute unauthorized code, exposing development environments to compromise. CVE-2025-55319 is a critical command injection vulnerability that shows how prompt injection can subvert agentic AI systems, with direct impact on code integrity and supply chain security.
Agentic AI means autonomous AI agents that can perform complex tasks inside software environments. Visual Studio Code is one of the most widely used code editors in the world, with millions of users and extensive support for AI-powered extensions. Combining the two has sped up development, and it has also opened new attack surfaces.
Technical Information
CVE-2025-55319 is an AI command injection vulnerability affecting Agentic AI integrations with Visual Studio Code. It comes from the way AI agents read and act on natural language instructions, including instructions embedded in untrusted content such as README.md files, code comments, or external documentation.
An attacker exploits this by writing malicious prompts or instructions that make the AI agent perform unauthorized actions when it processes them. Those actions include modifying critical configuration files (such as .vscode/settings.json), disabling security features, and executing arbitrary shell commands. The vulnerability triggers when an AI agent running with elevated permissions cannot reliably tell legitimate user instructions apart from maliciously crafted content.
The root cause is insufficient separation between user-driven commands and external content, which lets prompt injection escalate privileges. Exploitation needs no authentication and can be done remotely over the network, as long as the attacker can influence content the AI agent will process. No public source has published specific vulnerable code snippets.
Affected Systems and Versions
- Agentic AI integrations with Visual Studio Code
- All versions supporting autonomous AI agents that can modify files and execute commands
- Environments where AI assistants have permission to modify
.vscode/settings.jsonor execute shell commands - No specific version ranges or patch levels have been published as of this writing
Vendor Security History
Microsoft has fixed vulnerabilities in AI-powered tools before, including GitHub Copilot and Visual Studio Code extensions. Prompt injection and command execution issues have been reported in related products, and Microsoft has typically responded with advisories and patches. The company runs a public Security Response Center and has acknowledged CVE-2025-55319 in its advisories.
