Akamai AI Agent Attacks Decoded: Inside the Vibe Hacking, CursorJacking, and CometJacking Taxonomy

TL;DR: Akamai has named three AI agent attack classes practitioners need to understand now. Vibe hacking poisons markdown instruction files to manipulate agent behavior at the planning layer. CursorJacking uses rogue browser extensions to steal long-lived API keys. CometJacking hijacks agentic browsers through indirect prompt injection hidden in retrieved web content. Each exploits a distinct trust boundary that WAFs, EDR tools, and SAST scanners cannot reach.

Key Takeaways

• Vibe hacking embeds malicious instructions in markdown configuration files the agent treats as authoritative, bypassing input validation entirely.
• CursorJacking routes a rogue browser extension across AI agent API keys and tokens, exfiltrating long-lived credentials silently.
• CometJacking hides natural-language instructions inside retrieved web content, redirecting agent actions before any network-layer control sees the payload.
• A single successful injection can cascade across an environment because agents hold persistent file-system access and long-lived credentials.
• WAFs fail because agent instructions arrive as file-system content or retrieved text, not malformed HTTP requests.
• Akamai's agentic framework enforces identity and trust at the planning layer, intercepting malicious instruction flows before the agent acts.

Introduction

AI coding agents such as Cursor and GitHub Copilot Workspace are production infrastructure in enterprise environments as of June 2025. They carry persistent file-system access, long-lived API credentials, and browser automation privileges, and that trust surface is also an attack surface.

What Is Vibe Hacking and Why Do Poisoned Markdown Files Bypass AI Coding Agent Guardrails?

Vibe hacking embeds malicious instructions inside markdown files (such as .cursorrules or AGENTS.md) that AI coding agents read as trusted configuration, bypassing input validation because the agent treats file-system content as authoritative by design.

Any attacker who gains write access to a repository (through supply-chain compromise, a malicious pull request, or a poisoned dependency) can plant instructions that exfiltrate secrets, open backdoors, or silently modify build outputs. The agent cannot distinguish a legitimate instruction file from an attacker-authored one because the content arrives through the file system, entirely outside WAF rules and SAST scanners.

Akamai is direct: agentic attacks must be stopped before the planning or execution phase, because once the agent acts, the damage is done. The trust boundary that fails is file ingestion. The detection signal to monitor is unsigned or unexpected additions to agent-consumed instruction files in your repositories.

Audit every markdown instruction file your agents consume as if it were executable code, because to the agent, it is.

How Does CursorJacking Steal API Keys, and What Makes It Different from a Standard Browser Extension Supply-Chain Attack?

A standard extension supply-chain attack targets user session cookies. CursorJacking's target is the long-lived API credential an AI agent uses to authenticate against repositories, cloud services, or model APIs, credentials that carry elevated permissions and rotate infrequently. Extensions can be updated after initial review, and an agent's credential flows can pass through browser-resident processes that extensions are positioned to observe.

Treat your AI agent's API keys with the same rotation discipline as root credentials, and treat browser extension permissions as a first-class attack surface.

What Is CometJacking and How Does Indirect Prompt Injection Hijack an Agentic Browser Mid-Session?

An agentic browser navigating a page as part of a multi-step task may encounter hidden text (inside a zero-pixel element, a white-on-white comment, or a manipulated document) instructing it to forward the session's authentication token to attacker infrastructure. The LLM planner treats all retrieved content as context and acts on the injection. This is harder to detect than cross-site scripting because the payload never executes as JavaScript; it executes as language, outside the reach of WAF rules or Content Security Policy.

Enterprises cannot patch a retrieval-context vulnerability they do not own, that responsibility belongs to the vendor shipping the agentic feature. Trust enforcement at the planning layer is the practical mitigation available to defenders today.

CometJacking is not an application vulnerability. It is a retrieval-context vulnerability, and addressing it requires trust enforcement at the planning layer, not the network edge.

Which Existing Security Controls Fail Against These Attack Classes, and What Does Akamai's Agentic Framework Actually Intercept?

WAFs, EDR tools, and browser sandboxing fail because these attacks operate inside the instruction context of an AI agent (a layer where traditional controls have no inspection jurisdiction) while Akamai's framework intercepts threats by enforcing identity and trust at the planning layer before the agent executes.

Trust Boundary Matrix: Akamai AI Agent Attack Classes (as of June 2025)

Akamai's framework enforces identity, observability, and trust at the point of interaction before the planning or execution stage, with bot and agent controls that address credential abuse at agentic speed

Frequently Asked Questions

What is the difference between Vibe hacking and a standard prompt injection attack? Vibe hacking uses poisoned file-system content (instruction files the agent reads as authoritative configuration) not user-supplied input through a form or API. Defense requires treating every markdown file in an agent's context as executable.

How does CometJacking differ from a reflected XSS attack in practical detection terms? CometJacking's payload is natural language executed by an LLM planner, not JavaScript executed by a browser engine. Detection requires monitoring what the agent decided to do after visiting a page, not what the page ran.

Does Akamai's agentic security framework require changes to how an enterprise deploys its AI agents? Akamai's framework enforces trust at the point of interaction rather than inside agent logic , placing controls between the agent and the resources it accesses. For deployment-specific integration requirements, consult Akamai's documentation directly.

Conclusion

Most security teams lack runbooks that reference Vibe hacking, CursorJacking, or CometJacking by name or map them to specific detection signals. That classification gap is the immediate problem to close.

Audit three things now: every markdown instruction file your agents consume, every browser extension with access to sessions where agent credentials are present, and the scope and lifetime of every API key your agents hold. Akamai's approach of enforcing identity and trust at the planning layer points in the right architectural direction.

The attacks have names. For each of the three, identify one named detection signal in your current tooling. If you cannot name the signal, you have found your first gap.

Learn from me

Forward Deployed Engineering Bootcamp for Full-Stack Developers, my Maven cohort. Build and ship complete AI products end to end, from React and Node.js frontends to deployed models with caching and observability. Join the next cohort →

Hire us

Traversaal.ai. We're a team of forward deployed engineers solving the toughest AI problems for Fortune 100 companies: document intelligence, agentic data platforms, and real-time web intelligence, deployed in production. Work with our team to deploy your next agentic ecosystem. Talk to Traversaal.ai →

Join us

Want to solve these problems with us? We're always looking for forward deployed engineers who want to ship production AI. jobs@traversaal.ai