Do Son 
In a 2025 study titled Your AI, My Shell: Demystifying Prompt Injection Attacks on Agentic AI Coding Editors, researchers tested 314 malicious instruction payloads against GitHub Copilot and Cursor. Under certain experimental conditions, they achieved an attack success rate of up to 84% in getting AI coding agents to execute malicious commands. These findings raise security concerns for enterprises using AI Agents to analyze, refactor, and modernize existing applications.
During legacy software modernization, AI coding agents often examine source-code comments, configuration files, and technical documentation to understand existing functionality and dependencies. This reliance on repository content creates a potential attack vector: if an attacker can manipulate the information an agent encounters, malicious instructions could be presented as legitimate development guidance. An agent that follows such instructions may introduce unauthorized code changes, weaken security controls, or execute unintended commands.
This type of attack, known as prompt injection, highlights the risks of allowing AI coding agents to act on untrusted repository content. This article explains how prompt injection works, why AI coding agents are vulnerable when working with legacy repositories, and what safeguards enterprises can implement during modernization.
What is Prompt Injection?
Prompt injection is a security vulnerability in which malicious instructions embedded in untrusted content attempt to redirect an AI system away from its authorized task. For AI coding agents, these instructions may appear in source-code comments, README files, configuration files, documentation, or other external content they encounter while analyzing or modifying applications.
A documented demonstration of this vulnerability came in April 2026, when security researchers disclosed a technique called Comment and Control. They showed how malicious instructions hidden in GitHub issues and pull request content could manipulate AI coding agents. In one controlled test, instructions concealed within an HTML comment in a GitHub issue caused Copilot Agent to expose sensitive information from its execution environment.
Why AI Coding Agents are at Risk
During legacy app modernization, AI coding agents analyze existing source code and supporting documentation to understand application behavior and determine appropriate changes. This often requires interpreting historical design decisions, undocumented dependencies, and maintenance instructions whose original context may be unclear. Attackers can exploit this uncertainty by embedding malicious instructions that appear to be legitimate compatibility requirements or refactoring guidance, potentially influencing the agent’s subsequent actions.
1. Unverified Repository Content Can Mislead Agents
Legacy repositories often contain years of source-code comments, maintenance notes, and documentation whose accuracy is difficult to verify. This dependence on fragmented historical knowledge not only contributes to the hidden operational costs of legacy systems but also complicates how AI coding agents reconstruct application logic during modernization.
When reliable documentation is unavailable, agents may rely on unverified repository content to interpret existing business rules. Attackers with the ability to modify this content can exploit that uncertainty by inserting malicious instructions disguised as maintenance guidance, potentially influencing the agent’s proposed code changes.
2. Malicious Instructions Mistaken for Legitimate Requirements
AI coding agents interpret both programming languages and natural-language descriptions. While analyzing the authentication module, an agent could mistake the malicious comment for a genuine compatibility requirement rather than treating it as untrusted information.
If the agent accepts this instruction, it may propose removing authentication checks despite the developer’s original requirement to preserve existing security behavior. This happens when repository content is incorrectly given the authority of an authorized developer’s instructions.
3. Agent Permissions Enable Unauthorized Actions
The impact of prompt injection depends on the tools and permissions available to the agent. Coding agents with file-editing or command-execution capabilities may turn malicious instructions into actual changes within the development environment.
Without properly enforced access restrictions, an agent could modify files outside the assigned refactoring scope, execute unauthorized commands, or expose credentials available in its execution environment. This makes agent permissions a critical factor in determining potential attack damage.
How to Prevent Prompt Injection in AI-Assisted Legacy Modernization
Application modernization solutions that use AI coding agents need controls that distinguish historical code context from authorized development instructions. These safeguards should prevent malicious repository content from directing refactoring decisions while preserving intended application behavior.
1. Verify Legacy Code Instructions Against Actual System Behavior
Historical comments and maintenance instructions in legacy repositories may not reflect current application requirements and should not be treated as authoritative.
To establish reliable requirements, teams should first examine how the relevant functionality behaves in the existing application, using execution traces, available test cases, and dependency analysis where appropriate. They should then cross-check repository-derived instructions against approved business rules and modernization specifications to determine whether the proposed change is justified.
Agent workflows should enforce this distinction by treating repository content as reference material rather than authorization to modify code. When instructions conflict with observed behavior or approved requirements, the agent should flag the discrepancy for review instead of independently resolving it through code changes.
2. Restrict Agent Permissions During Code Analysis and Refactoring
AI coding agents may need access to multiple legacy modules for dependency analysis, but this should not automatically extend to modification rights.
To maintain this distinction, teams should limit write permissions to the approved modernization scope and run agents in isolated environments with controlled command execution. These restrictions help prevent malicious instructions encountered during repository analysis from triggering unauthorized modifications.
Read-only access alone, however, does not prevent sensitive information from being exposed. Agents should also have restricted access to credentials and controlled outbound network connections, particularly when working with legacy repositories containing sensitive configuration details.
3. Use Characterization Tests to Detect Unauthorized Logic Changes
Legacy applications may contain poorly documented business logic that attackers can exploit by disguising unauthorized changes as compatibility fixes or code cleanup.
Before refactoring, teams should establish a baseline of existing application behavior through characterization tests. These tests help identify unexpected differences introduced by AI coding agents, allowing reviewers to investigate whether the changes align with approved software modernization requirements.
However, characterization tests only cover the scenarios they are designed to capture, and existing behavior is not necessarily correct or secure. Teams should therefore supplement them with regression testing and code review to distinguish unauthorized modifications from legitimate improvements.
4. Require Approval for Changes to Legacy Business Logic
AI coding agents can recommend changes to legacy business logic, but decisions affecting critical functionality should remain subject to human approval. This is particularly important when historical documentation is incomplete, and the consequences of modifying established rules are difficult to determine.
Senior engineers and domain specialists should review high-impact changes before implementation, using the agent’s proposed modifications and supporting evidence to assess their necessity. To support this review, agent activity records should capture the repository content consulted, actions performed, and reasons given for proposed changes.
This traceability helps reviewers identify whether untrusted instructions influenced an agent’s decisions and investigate suspicious modifications before they affect business-critical systems.
The Takeaway: Secure AI Adoption Requires More Than Coding Capabilities
AI coding agents can accelerate legacy modernization, but their effectiveness depends on the safeguards governing how they interpret existing code and execute changes. For enterprises already dealing with undocumented business logic, complex dependencies, and limited legacy-system expertise, establishing these controls internally can be particularly challenging.
Before expanding agent autonomy, enterprises should assess their ability to enforce instruction boundaries, validate changes against business requirements, and maintain oversight of critical code modifications. Where these capabilities are limited, specialized legacy application modernization services can provide the engineering expertise and structured governance needed to implement AI-assisted workflows securely. The priority should be to establish these safeguards before granting agents greater control over business-critical applications.
*Author bio *
Amelia Swank is a seasoned Digital Marketing Specialist at SunTec India with over eight years of experience in the IT industry. She excels in SEO, PPC, and content marketing, and is proficient in Google Analytics, SEMrush, and HubSpot. She is a subject matter expert in Application Development, Software Engineering, AI/ML, QA Testing, Cloud Management, DevOps, and Staff Augmentation (Hire mobile app developers, hire WordPress developers, and hire full stack developers etc.). Amelia stays updated with industry trends and loves experimenting with new marketing techniques.