How Malicious Repo Content Hijacks an AI Coding Agent

Malicious content hiding inside ordinary repository files, README text, skill definitions, Git configs, dependency manifests, can hijack an AI coding agent and turn its own delegated permissions against the developer who granted them. Developers and platform teams who want to run agentic workflows safely need to understand these three entry points and how privilege escalates through each of them.

Repo content as an attack surface beyond the configuration layer

Coding agents operate in what amounts to a post-trust regime. A developer grants permission to a project folder once, and after that, the agent invokes tools, reads files, and runs commands without asking for confirmation on every single step. That's automation by design. It is also a vulnerability by consequence, because the agent's willingness to act without friction extends to any content sitting in that folder, regardless of who put it there.

The critical thing to hold onto here is that an attacker doesn't need to touch the agent's system prompt, and doesn't need to intercept any network traffic. Placing or renaming a file inside the workspace is enough. The adversary behind that file could be a malicious repository maintainer, a contributor submitting an innocuous-looking pull request, or the maintainer of a dependency several layers upstream that got compromised without anyone noticing. None of these actors need elevated access. They need write access to something the agent will eventually read.

This is a different category of problem from the prompt injection people have been discussing for a couple of years, because a successful attack here produces real system actions, not just harmful text. Credential theft, file deletion, outbound exfiltration: these aren't outputs a developer can review and reject after the fact, because by the time anyone sees them, they've already executed. Researchers behind the paper "How Agentic AI Coding Assistants Become the Attacker's Shell" (Liu et al.) trace the root cause to something specific: current coding assistants cannot reliably separate trusted developer instructions from attacker payloads when both arrive in the same token stream. It's a conflation baked into how these systems process context, and it's the reason three separate entry points, instruction files, documentation files, and source code files, all work through the same underlying weakness. The rest of this piece develops each of those in turn.

Entry point one: instruction and rules files the agent loads before the developer types anything

Rules files are the semantic configuration layer of modern coding agents: .cursorrules, .github/copilot-instructions.md, and the various "skill" folders that let an agent specialize its behavior for a given project. They exist for good reasons. They also load automatically, which is exactly the problem.

The attack mechanic is almost insultingly simple. An attacker places a malicious rules file inside a public repository. A developer clones it, opens it in an agent-enabled editor, and the agent processes that file as trusted configuration before the developer has typed a single prompt. No social engineering required, no phishing email, just a file sitting where the agent is guaranteed to look.

The severity numbers here are not marginal. Liu et al. catalogued 314 unique payloads mapping to 70 separate MITRE ATT&CK techniques, and found that success rates for executing malicious commands ranged from 41% to 84% depending on the platform tested. A separate benchmark from Yang et al., built around 2,826 adversarial skills synthesized from 471 real-world shell commands across 11 MITRE ATT&CK tactics, ran 5,629 completed sessions and found Gemini CLI exploited in 95.5 to 96.1% of runs, and Qwen Code exploited in 71.6 to 74.0% of runs Towards a Risk Assessment of Malicious Skill Files in Coding Agents Setup Complete, Now You Are Compromised: Weaponizing Setup Instructions Against AI Coding Agents A Blind Trust, the Bloody Thrust: When Attacker-Controlled Hook Updates Steer AI Agent Harnesses towards Malicious Behaviors. Explicit safety recognition, the agent actually flagging the payload as suspicious, happened in only 1.99% of those runs Towards a Risk Assessment of Malicious Skill Files in Coding Agents Setup Complete, Now You Are Compromised: Weaponizing Setup Instructions Against AI Coding Agents A Blind Trust, the Bloody Thrust: When Attacker-Controlled Hook Updates Steer AI Agent Harnesses towards Malicious Behaviors.

That number demands attention. It means agents are treating malicious payloads as legitimate operational context in nearly every single encounter Towards a Risk Assessment of Malicious Skill Files in Coding Agents. The model's trained refusal behavior, the thing every safety team points to when asked how their system resists misuse, is structurally sidestepped the moment a payload is framed as a project instruction rather than a user request Towards a Risk Assessment of Malicious Skill Files in Coding Agents. Refusal training was built to catch a user asking for something harmful, not a skill file quietly claiming the authority of the project itself.

The minimum viable version of this attack is almost absurdly small. OWASP research cited in Liu et al. found that three lines of hidden markdown in an imported skill file are enough to trigger silent SSH key exfiltration. Three lines. And the pattern isn't theoretical: CVE-2025-62222, disclosed against GitHub Copilot, involved prompt injection hidden in source files that tricked the assistant into modifying .vscode/settings.json to auto-approve terminal commands, achieving remote code execution with no user interaction at all.

Rules files, at least, are loaded because a developer chose to open the project. The next entry point doesn't even require that much.

The.git config vector: how ordinary Git plumbing becomes the payload delivery mechanism

Manifold Security's GitSpawn disclosure, published September 1, 2026, documented eight separate Git config flaws spread across seven command-line AI coding agents, four of which were still unpatched at the time of publication. The mechanism at the center of it is core.fsmonitor, a Git performance setting whose value is, by design, a shell command. Git reads that value directly out of the repository's own .git/config file and executes it on any operation that refreshes the index, including git status and git diff. Coding agents run exactly those commands in the background at session startup, just to figure out what branch is checked out and what files have changed.

The timing here should alarm anyone running these tools. On Claude Code and Hermes Agent, the payload fires before the workspace-trust prompt is even accepted. On Qwen Code, it fires before the user has authenticated. On Grok Build, it fires on the first keystroke. The advisory for goose's corresponding vulnerability, CVE-2026-72718, rated at a CVSS 4.0 base score of 7.0, states the consequence: running goose review inside a malicious repository runs attacker code, with no submitted prompt, no model call, no tool approval, and no trust prompt. The command executes before goose ever contacts the model Malicious.git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code.

Patch status as of Manifold's September 1 retest varied widely across the affected tools. Goose was vulnerable in all versions prior to 1.44.0, fixed in that release. Codex Desktop for macOS carried the flaw from build 260202.0859 through 26.513.31313, fixed in 26.519.22136, and the Windows build was vulnerable from 26.304.38 through 26.513.40821, fixed in 26.519.21041, with a parallel fix for the Microsoft Store package When Context Gets Root: Privilege Escalation in LLM Harnesses. Claude Code's core.fsmonitor path was confirmed on 2.1.193 and fixed by 2.1.196, though a separate path through claude ultrareview remained live on 2.1.252 at time of publication. Hermes Agent, Qwen Code, and Grok Build all had confirmed vulnerable builds with fixes still pending When Context Gets Root: Privilege Escalation in LLM Harnesses.

One important caveat limits how this spreads: the attack requires the repository to arrive with its .git directory intact. A shared archive, a shared drive, a sync folder, or a USB stick preserves that directory. An ordinary git clone skips it. That's a meaningful constraint, but it is also how a lot of internal code actually moves between machines in real organizations.

None of this was an isolated finding. OpenAI published three separate CVEs the same day covering the identical vulnerability class in Codex, credited to three unconnected research groups working independently. When three different teams find the same bug class on the same day without coordinating, that's a signal the underlying pattern is not some obscure edge case. A related finding, CVE-2025-36730 in Windsurf, showed that even a maliciously crafted filename, not the file's contents, can get appended into an assistant's prompt and used to exfiltrate data without any user action. The lesson generalizes past file contents: metadata sitting adjacent to a file is its own vector.

Both of these entry points operate at the boundary of the repository itself. The third moves the attack deeper, into how agents delegate work to each other. Codex CLI versions 0.102.0 through 0.130.0 are affected, with a fix released in 0.131.0, as detailed in When Context Gets Root: Privilege Escalation in LLM Harnesses.

Entry point three: how privilege escalates through the instruction hierarchy when agents delegate to subagents or load external context

He et al.'s paper "When Context Gets Root: Privilege Escalation in LLM Harnesses" names the mechanism precisely as instruction privilege escalation: the harness itself, the software wrapper around the model, constructs context for each invocation in a way that can promote tool-level content up to user-level or even system-level instruction. Two distinct forms appear in their research. Tool-to-user escalation happens when a main agent delegates a task to a subagent, and the harness inserts tool-generated content into that subagent's context labeled as a user message, so the subagent treats attacker content as if it were the developer speaking directly. Tool-to-system escalation is worse: malicious tool-level content gets folded into a custom subagent's system prompt itself, becoming system-effective instruction the moment that subagent is invoked.

The evaluation results are stark. Across 13 attack objectives spanning confidentiality, integrity, availability, and remote code execution, unrestricted action execution achieved all 13 objectives on all six harnesses tested When Context Gets Root: Privilege Escalation in LLM Harnesses. Under automatic permission review, the mode meant to catch exactly this kind of thing, all 13 objectives were still achieved on all three harnesses that offered that review mode When Context Gets Root: Privilege Escalation in LLM Harnesses. Permission review failed completely because the reviewer relies on role labels in the interaction history to decide who authorized an action, and if the harness has already relabeled attacker content as user intent, the reviewer is looking at fabricated authorization and has no way to know it.

This appears in production, not just in benchmarks. Indirect prompt injection against Cursor caused its agent to create a malicious .cursor/mcp.json configuration file without any user approval, and the attacker achieved remote code execution through that planted configuration, a live instance of tool-to-system escalation. A separate Cursor flaw, CVE-2026-22708, inverted the purpose of allowlisting entirely: an attacker poisons the execution environment so that allowlisted commands like git branch deliver arbitrary payloads, and the exact mechanism built to reduce friction ended up auto-approving the commands the attacker needed most. And in Claude Code, CVE-2026-21852, rated CVSS 5.3, lets an attacker redirect API requests to a proxy under their control, capturing the full authorization header, plaintext API key included, before any trust prompt ever appears; in a team using Anthropic's Workspaces feature, one stolen key exposes the entire team's data.

This is not the model misreading a role label. The harness genuinely places attacker content at a higher privilege level. Model-side refusal training, the thing everyone points to as the safety net, simply isn't the relevant defense here.

How the MCP ecosystem widens the attack surface beyond the local repository

The developer never has to open a bad file.

The agentjacking vector documented against Sentry in June 2026 shows how little an attacker needs. Using only a publicly discoverable Sentry DSN, attackers injected malicious instructions into Sentry error events; agents including Claude Code, Cursor, and Codex then retrieved those poisoned events through MCP and executed attacker-controlled commands under the developer's own system privileges. The developer never touched anything malicious directly.

A parallel class, dubbed PromptPwnd and disclosed by RyotaK of GMO Flatt Security in January 2026, changes the attack prerequisite in a way that matters enormously Snyk ToxicSkills audit. An adversary used to need write access to a trusted repository to cause damage. Now, all that's needed is the ability to open an issue or a pull request, capabilities available to any GitHub user with a free account Snyk ToxicSkills audit. Aikido Security identified at least five Fortune 500 companies running misconfigured AI agent workflows consistent with this exact pattern as of mid-2026 Snyk ToxicSkills audit.

Supply chain poisoning has already reached MCP servers themselves. A package called postmark-mcp shipped several clean versions first, building legitimacy the way any trusted package does, before quietly adding a single line of exfiltration code, a classic version-latency poisoning technique applied to a new kind of registry. Separately, CVE-2025-6514, a remote code execution flaw rated 9.6 on the CVSS scale, was disclosed in core MCP infrastructure used by hundreds of thousands of developers.

Underneath all of this sits a structural mismatch. IAM policies were designed around human operators and service accounts with narrow, well-scoped permissions. An agent calling multiple MCP servers in a single workflow ends up holding the union of everything every one of those servers can do, and auditing that combined permission set after the fact is extremely difficult. SOC 2 Type II audits have started asking pointed questions about AI system access controls, and organizations that cannot produce a reviewable access log for every action their agent took are going to fail that section of the audit. MCP serves as an attack relay: agents retrieve context from MCP servers during normal operation, and if a server is compromised or malicious, it becomes a remote injection point that does not require any change to the local repository.

A successful hijack at organizational scale: the Mandiant Shai-Hulud incident

Mandiant's September 2026 report, covered by The Hacker News, described an attacker hijacking an active AI coding-assistant session at an unnamed SaaS provider. The agent recommended a piece of software the attacker had already poisoned, and the recommendation was accepted. From there, the attacker used the developer's own active session to install an infostealer through a poisoned PyPI package, and GitHub OAuth tokens were stolen as a direct result. The self-spreading Shai-Hulud worm then deployed across roughly 100 internal code repositories Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories. In one particularly ugly turn, the attacker poisoned a package inside the company's own official namespace, and a second employee pulled the compromised version, triggering a second infection without the attacker doing anything further.

The worm's reach extended past this one company. A Shai-Hulud variant was found scanning 469 separate locations for credentials, spanning developer systems, CI/CD tooling, cloud configuration files, and AI tool configuration files themselves. That's not just credential theft; it's a map of everywhere credentials tend to live.

Mandiant's earlier report from March 2026 documented that attackers moved during 2025 from using generative AI mainly to speed up their own work toward using large language models inside the malware and the attacks themselves.

Mandiant's recommendations following the incident were specific: verify AI-recommended third-party dependencies against cryptographic checksums and approved allowlists, keep raw API keys and long-lived OAuth tokens out of direct reach of extensions, and route dependency traffic through controlled internal repositories. What the incident really illustrates, though, is a point about privilege rather than about any single control. The agent's delegated authority, its access to the session, to the package manager, to OAuth tokens, became the lateral movement mechanism on its own. The attacker never needed to escalate privileges, because the agent already held everything required.

There's a useful precedent for the scale involved here. The March 2025 compromise of tj-actions/changed-files and reviewdog/action-setup affected roughly 23,000 repositories through CI/CD Action distribution. Shai-Hulud shows that AI coding sessions now carry a comparable blast radius, with the agent's own reach substituting for what a compromised Action's distribution channel used to provide.

Why existing defenses are structurally insufficient against these three entry points

Current coding assistants cannot reliably distinguish trusted developer instructions from attacker payloads in the same token stream, which is the root cause, not a model flaw. Rules files exploit that by loading before a prompt exists. The Git config vector exploits it by running before the agent even contacts the model. Instruction privilege escalation exploits it inside the harness itself, relabeling tool output as user intent so convincingly that permission review, the defense specifically built to catch unauthorized actions, approved all 13 tested attack objectives anyway When Context Gets Root: Privilege Escalation in LLM Harnesses.

Patching individual CVEs helps, and vendors have shipped fixes for several of the vulnerabilities described here. But four of the eight Git config flaws found in the GitSpawn disclosure remained unpatched at publication, and the model-level defense everyone points to, refusal training, produced explicit safety recognition in only 1.99% of the 5,629 completed runs in the Monash/Melbourne benchmark Towards a Risk Assessment of Malicious Skill Files in Coding Agents Setup Complete, Now You Are Compromised: Weaponizing Setup Instructions Against AI Coding Agents A Blind Trust, the Bloody Thrust: When Attacker-Controlled Hook Updates Steer AI Agent Harnesses towards Malicious Behaviors. A defense that fails at that rate is a control operating in the wrong layer, one that misses where the attack actually happens, and until agent architectures separate instruction authority from content ingestion at the harness level rather than the model level, every one of these three entry points stays open.