Pattern: User-Agent Cloaking Has Arrived as an Attack Delivery Mechanism Against Coding Agents

GitHub·high signalXBlueskyLinkedInCopy link

Prompt injection via web content is old news; serving that injection *only* to agent user-agents while showing humans a 403 is the escalation. It defeats the standard verification loop — a developer told 'this site tried to inject me' opens the URL, sees a block page, and concludes the agent hallucinated. Expect this to generalize: any site can now A/B its content by UA, and the agent-facing variant is invisible to manual review, to your browser history, and to most link-safety scanners. The defensive primitive that survives is capability restriction at the tool layer, not content inspection.