LLM-Mediated Codebase Reconnaissance

Adversary Behavior: An adversary uses prompt injection to direct an LLM-integrated coding agent to systematically enumerate and report information about the target development environment, leveraging the agent's privileged insider position.

AI/IDE Mechanism: The coding agent has deep read access to the entire project — including source code, configuration files, infrastructure-as-code definitions, environment variables, and documentation. This access scope, designed for productive code generation, provides comprehensive visibility into the development environment's architecture and configuration.

Execution Path: The adversary embeds reconnaissance instructions in project files, pull requests, or documentation that the LLM ingests as context. The agent extracts architectural details, internal API schemas, credential storage locations, dependency manifests, and deployment configurations. The gathered intelligence is surfaced through generated code comments, exfiltrated via tool invocations, or embedded in outputs that the adversary can later retrieve.

Security Impact: Unlike traditional reconnaissance which operates externally, this technique leverages the LLM agent's privileged insider position within the development environment, providing the adversary with comprehensive internal intelligence including architecture, credentials, dependencies, and deployment configurations without triggering perimeter-based detection.