Hijacking Windsurf: How Prompt Injection Leaks Developer Secrets

This is the first post in a series exploring security vulnerabilities in Windsurf. If you are unfamiliar with Windsurf, it is a fork of VS Code and the coding agent is called Windsurf Cascade . The attack vectors we will explore today allow an adversary during an indirect prompt injection to exfiltrate data from the developer’s machine.

Summary from Embrace The Red.

Explained

The technology and terms in this story. Learn more

More in Vulnerabilities