TeamPCP tried to manipulate AI coding assistants through poisoned project files

MALICIOUS INSTRUCTIONS INSIDE ORDINARY PROJECT FILES

Google Threat Intelligence Group reported in September 2026 on UNC6780, also known as TeamPCP, an actor associated with attacks on software supply chains. Researchers found mechanisms in the group's DUSTMAKER malware that tried to influence AI coding assistants by placing instructions in files the assistants would read.

This differs from a conventional exploit that relies on a programming bug. The attacker tries to make untrusted project content look like instructions from someone with authority. If an assistant treats it as such, it may carry out actions the user never intended.

THE PROMPT-INJECTION RISK

The technique is known as prompt injection. TeamPCP reportedly placed manipulative text in configuration files and script comments associated with coding tools. Google also described attempts to derail language-model-based security analysis with material designed to trigger safeguards and interrupt inspection of malicious code.

The investigation does not imply that every model obeyed the attacker. Google's account also describes defensive measures that disrupted the campaign.

WHY DEVELOPERS SHOULD CARE

Software development increasingly involves assistants that can run commands, install dependencies and change project files. A compromised package, repository or configuration file can therefore become an indirect route to the assistant itself.

THE PROMPT ANALYSIS

AI assistants need a firm boundary between a developer's authorized instructions and untrusted content from outside projects. Installation, access to secrets and production deployment should remain subject to separate permissions and checks. The security of a coding assistant depends as much on the surrounding tools as on the model.

Original source: Google Threat Intelligence Group, 8 September 2026. https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai