# Untrusted project config injected into system prompt

Project config keys that feed the system prompt without the path and trust checks file tools enforce

_Area: AI and LLM app security. Seen in 2 disclosed reports; latest 2026-09-04. Updated 2026-11-08._

## How it works

An AI coding agent loads project-level config from the repo it opens and merges it into the session that builds the model's system prompt. The assumption that breaks: project config is treated as trusted because it lives in the workspace, but the workspace is attacker-controlled once a victim clones or opens a malicious repo. Keys that only tune behavior (model, provider) are gated; keys that carry text into the system prompt (`instructions`, rules, context files) are not, so a repo can point the agent at arbitrary files or inject its own instructions into the trusted prompt [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-62f5-cp2p-vq95.md)[E3](https://bugbountylibrary.com/r/blog%3Aresearch-checkpoint-com-2026-free-the-model-sell-the-gateway-prompt-adware-hidden-in-jailbreak-bundles.md).

## Where it shows up

- A config merge function that copies project keys into session config, with a deny-list for secrets/endpoints but no entry for prompt-feeding keys [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-62f5-cp2p-vq95.md)
- Path expansion (`~`, env vars) applied to config-supplied paths before a plain file read, with no workspace-boundary check [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-62f5-cp2p-vq95.md)
- File tools that call a `resolve_path`/sandbox helper while the instructions loader reads directly [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-62f5-cp2p-vq95.md)
- IDE-auto-populated env vars (e.g. `CLAUDE_PROJECT_DIR`) treated as trusted source roots [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-gvpp-v77h-5w8g.md)
- "Is this our code?" checks that only test for a directory and a file existing [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-gvpp-v77h-5w8g.md)
- Global instruction/persona modules shipped in bundles that react to trigger words [E3](https://bugbountylibrary.com/r/blog%3Aresearch-checkpoint-com-2026-free-the-model-sell-the-gateway-prompt-adware-hidden-in-jailbreak-bundles.md)

## How to review

For every project-config key, ask: does its value reach the system prompt or a file read? If yes, it must pass the same trust boundary as file tools — resolved paths confined to the workspace, no `~`/env expansion outside it, and no project-scope override of prompt content. For env-var-derived roots, require a real identity check (signature, remote origin), not marker files. For installed prompt modules, diff them against the expected set and look for trigger-word conditionals. The invariant: untrusted repo content may inform the model only as clearly delimited data, never as trusted instructions or as a pointer to files outside the workspace.

## How finders spotted it

- Read the config merge path and compared the deny-list against the file-tool sandbox: `api_key`, `base_url`, `provider`, `mcp_config_path` were blocked at project scope, `instructions` was not, and the loader skipped `resolve_path` [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-62f5-cp2p-vq95.md)
- Traced `open_visualization.py` and saw `CLAUDE_PROJECT_DIR` in the dev-source candidate list, then checked `_is_cortex_root()` and found only two existence checks [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-gvpp-v77h-5w8g.md)
- Found a jailbreak bundle on a misconfigured server, then decrypted and analyzed its prompt modules rather than trusting the archive [E3](https://bugbountylibrary.com/r/blog%3Aresearch-checkpoint-com-2026-free-the-model-sell-the-gateway-prompt-adware-hidden-in-jailbreak-bundles.md)

## Variants seen

- Config key pointing at arbitrary paths (`~/.ssh/id_rsa`) read into the system prompt [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-62f5-cp2p-vq95.md)
- Repo-controlled `AGENTS.md`/`instructions.md` prompt injection chained to force output of leaked content [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-62f5-cp2p-vq95.md)
- Env-var-derived source root leading to execution of repo-supplied bootstrap code [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-gvpp-v77h-5w8g.md)
- Global prompt module injecting ads on trigger words, persisting across sessions [E3](https://bugbountylibrary.com/r/blog%3Aresearch-checkpoint-com-2026-free-the-model-sell-the-gateway-prompt-adware-hidden-in-jailbreak-bundles.md)

## Impact and severity

High: silent read of any user-readable file into the model context, exfiltrated via chained prompt injection [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-62f5-cp2p-vq95.md); code execution as the victim user, plus persistence via cache rsync [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-gvpp-v77h-5w8g.md); persistent tampering of trusted global instructions and routing through an opaque gateway that can snoop data or inject tool calls [E3](https://bugbountylibrary.com/r/blog%3Aresearch-checkpoint-com-2026-free-the-model-sell-the-gateway-prompt-adware-hidden-in-jailbreak-bundles.md). Impact rises with chaining and with persistence beyond the malicious project.

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **deepseek-tui (rust)** >= 0.8.8, < 0.8.41, no fix yet: CodeWhale: Project config `instructions` override enables arbitrary file read into AI system prompt via cloned repositor (CVE-2026-75859). Report: https://bugbountylibrary.com/r/ghsa%3AGHSA-62f5-cp2p-vq95.md. Fix: https://github.com/Hmbown/CodeWhale/commit/43563356b98c6b993085554da82e77370160a31c
- **neuro-cortex-memory (pip)** <= 3.17.0, fixed in 3.18.0: Cortex has Untrusted Project Bootstrap Code Execution via `CLAUDE_PROJECT_DIR` (CVE-2026-49986). Report: https://bugbountylibrary.com/r/ghsa%3AGHSA-gvpp-v77h-5w8g.md

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-62f5-cp2p-vq95.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-gvpp-v77h-5w8g.md
- E3: https://bugbountylibrary.com/r/blog%3Aresearch-checkpoint-com-2026-free-the-model-sell-the-gateway-prompt-adware-hidden-in-jailbreak-bundles.md