Will any AI-coding-assistant company publicly disclose a prompt-injection-driven supply-chain incident in 2026?

About

Resolves YES if a major AI coding assistant vendor (GitHub Copilot, Cursor, Codeium, JetBrains AI, Amazon Q Developer, Tabnine) publicly discloses an incident in 2026 in which prompt injection from third-party content (e.g., README, package metadata, dependency source) caused an end-user code-supply-chain compromise.

Resolution criteria

Vendor security advisory or post-mortem in 2026 explicitly tying root cause to prompt injection AND end-user code/supply-chain impact.

Source

Vendor security pages; The Record; Bleeping Computer.

Ambiguity

AMBIGUOUS if the disclosure describes an LLM-related issue but not categorically prompt injection, or only an academic POC without confirmed exploitation.

Discussion

Loading comments…