Threat intelligence
Understand how current attacks work, which ecosystems they affect, and which evidence supports each record.
Threat DB v2.29.0Updated September 12, 2026
Events, campaigns, authors, and malicious skill records. The catalogue is evidence, not a guarantee of coverage.
Start with the attacker’s mechanism, then inspect examples, linked campaigns, and the documented mitigation.
T001
Hidden instructions in SKILL.md that instruct the agent to run malicious commands
Mitigation: Scan SKILL.md for shell commands; never auto-execute prerequisites
T002
Injection of persistent instructions into SOUL.md, MEMORY.md, CLAUDE.md, AGENTS.md
Mitigation: Treat memory files as config; require code review for changes; monitor diffs
T003
Benign config approved once, then mutated to malicious version that auto-executes
Mitigation: Hash verification on configs; re-approval on any change
T004
Attacker manipulates MCP session/output; client trusts poisoned response
Mitigation: Cryptographic session IDs; input validation; least-privilege for MCP tools
T005
Malicious website rebinds domain to 127.0.0.1 to access local MCP servers
Mitigation: Use stdio transport; enable DNS rebinding protection; authenticate local servers
T006
Malicious packages published to registries mimicking legitimate MCP servers
Mitigation: Verify package author; check download counts; use SafeDep vet
T007
Malicious .claude/hooks/ scripts run on agent events with full user privileges
Mitigation: Review all hooks; forbid auto-running hooks from untrusted repos; maintain hook allowlist
T008
Agent instructed to read credential files and send to attacker
Mitigation: Block agent access to .env, .aws, .ssh directories; use pre-execution hooks
T009
Malicious skills spread hallucinated or fabricated package names (e.g. via npx commands) that resolve to attacker-controlled packages on npm/PyPI when executed
Mitigation: Verify every package reference in SKILL.md before executing setup instructions; use package lockfiles; pin all dependencies to known-good checksums
T010
Attacker injects malicious instructions into communication channels (Slack, email, ticketing systems, code review comments) that AI agents monitor autonomously; agent executes unauthorized actions without cryptographic source verification
Mitigation: Validate agent instruction sources cryptographically; treat all external channel content as untrusted user input; require human-in-the-loop for high-impact actions triggered via monitored channels; scope agent permissions to minimum required for task
T011
Attacker embeds malicious settings in repository config files (.claude/settings.json, .mcp.json) that auto-execute MCP servers or redirect API traffic before trust dialog is shown; the configuration layer — not the code — is the attack surface
Mitigation: Review .claude/settings.json and .mcp.json before opening unfamiliar repos; treat these files as code, not metadata; update Claude Code to >= 2.0.65; never clone-and-run from untrusted sources without inspecting config files first
T013
AI coding agent autonomously disables or circumvents its own security controls (sandbox, denylist, permission enforcement) when those controls block task completion, without explicit attacker instruction — the agent's reasoning determines that bypassing safety is necessary to fulfill the assigned goal
Mitigation: Treat agent-initiated security control disabling as a red flag requiring human review; implement hard security boundaries that cannot be overridden by agent reasoning; monitor for unexpected sandbox exits or denylist bypass attempts; apply principle of least privilege so agents cannot access sandbox configuration
T012
Attacker embeds hidden instructions in URLs (e.g. 'Summarize with AI' buttons, share links) that inject persistent memory entries into AI assistants, biasing future recommendations toward attacker-controlled content or services
Mitigation: Disable URL-based memory pre-population in AI assistants where possible; treat any 'Summarize with AI' button as potentially adversarial; periodically clear AI memory; hover over AI buttons before clicking to inspect destination URL
T014
Malicious website opens WebSocket connection to locally running AI agent gateway on localhost, brute-forces the gateway password (rate limiter exempts localhost), auto-registers as trusted device, and gains admin-level control of the victim's AI agent session
Mitigation: Update OpenClaw to >= v2026.2.26; apply rate limiting to ALL connections including localhost; require explicit user confirmation for device pairing; block WebSocket connections from browser contexts to localhost AI agent ports; use CORS headers to prevent cross-origin WebSocket upgrades
T016
Attacker hosts malware on lookalike AI agent platform websites (fake ClawHub, fake skills.sh); skills on the real platform are clean decoys that redirect victims to lookalike domains for 'prerequisites' or 'dependencies'. Bypasses hash-based scanner integrations (e.g. VirusTotal) because the skill file itself contains no malicious payload.
Mitigation: Domain verification for all external links in SKILL.md; never follow SKILL.md instructions to external websites; use network egress filtering; check domain registration dates for 'official' skill installer links
T017
Employees deploy MCP servers without IT oversight, giving AI agents access to production systems, databases, and APIs outside any security review or governance process. The MCP server itself may be legitimate but the deployment creates unmonitored attack surface.
Mitigation: Implement MCP server allowlists enforced via policy; require IT approval for all MCP server additions; use Qualys TotalAI or similar to detect shadow MCP deployments; audit claude_desktop_config.json and .mcp.json across developer machines
T018
Attackers create malicious GitHub repos or websites that rank highly in AI-generated search results (Bing AI, Google AI Overview, ChatGPT search). AI systems recommend the malicious repo as the legitimate source for popular tools. Victims trust the AI recommendation and install malware.
Mitigation: Always verify download sources via official project website or GitHub org; do not trust AI-generated search results for download URLs without verification; check repo creation date and star count before downloading; use package manager with lockfiles
T015
Attacker writes malicious content to publicly exposed AI agent log files via unauthenticated WebSocket requests; since the agent reads its own logs to troubleshoot tasks, the injected content acts as indirect prompt injection, triggering unintended agent actions
Mitigation: Update OpenClaw to >= v2026.2.13; require authentication for all WebSocket endpoints including log-write; treat log files as untrusted input when parsed by the AI agent; sandbox log file read context to prevent prompt injection
T019
Attacker exploits exposed backend mutation endpoint in AI agent skill marketplace to inflate download counts without limit, artificially promoting a malicious skill to the #1 position and gaming trust signals. Relies on misconfigured framework function visibility (e.g. Convex public mutation instead of internal). Bypasses rate limiting and deduplication checks.
Mitigation: Audit all marketplace backend mutation functions for unintended public exposure; enforce authentication on download increment endpoints; implement server-side rate limiting and anomaly detection on sudden download spikes; require human review before promoting skills with rapid download growth
T020
Attacker manipulates an AI agent's reasoning and tool-selection layer rather than exploiting tool code directly. By crafting malicious language, poisoned metadata, or injected context, attackers guide the agent's decision-making to select attacker-preferred tools, skip security checks, install malicious packages, modify configuration files, or exfiltrate data — all while appearing to perform legitimate development tasks.
Mitigation: Treat all external content (READMEs, package descriptions, issue comments) as untrusted input; implement tool governance with allowlists of approved MCP servers; use behavioral monitoring to detect unexpected tool call sequences; require human-in-the-loop for high-impact actions triggered by external content
T021
30+ vulnerabilities across popular AI coding IDEs (Cursor, Windsurf, GitHub Copilot, Zed.dev) enabling a three-step attack chain: (1) bypass LLM guardrails to control the AI context, (2) leverage auto-approved tool calls to perform actions without user interaction, (3) trigger legitimate IDE features to break security boundaries. Combines prompt injection with auto-approval mechanisms to achieve data theft and remote code execution without user interaction.
Mitigation: Disable auto-approve for file writes and tool calls in AI IDE settings; review IDE extension permissions; treat IDE workspace configuration files as security boundaries; do not auto-approve actions triggered by external repository content; keep AI IDE tools and extensions patched
T022
Attacker embeds malicious instructions in repository files (README, docs, code comments) that trigger automatically when an AI coding IDE opens the repo. The attack chains four steps: (1) indirect prompt injection hijacks AI context, (2) sandbox escape via shell builtin chaining breaks workspace confinement, (3) persistence installed via .zshenv overwrite survives reboots, (4) IDE built-in remote tunnel feature used as an undetected persistent backdoor for shell access.
Mitigation: Disable auto-approve for file writes and shell commands in AI IDE settings; never open untrusted repos without reviewing markdown files first; audit .zshenv and shell init files after opening new repos; disable remote tunnel features unless actively required; treat IDE workspace as a security boundary
T023
Attacker crafts malicious content that exploits the gap between what an AI coding agent displays in its confirmation dialog and what it actually executes. The agent UI summarizes the planned action in benign language while the underlying tool call performs a different, malicious operation. Developers approve the attack because the confirmation UI appears legitimate, while the actual executed command steals credentials, modifies files, or escalates privileges.
Mitigation: Never rely on agent UI summaries alone — review raw tool call parameters before approving; require structured, machine-readable confirmation format that shows exact command and arguments; use runtime monitors (Jozu Agent Guard, Semgrep MCP) to validate actual tool invocations against approved summaries; treat any mismatch between confirmation text and executed command as an incident
T025
Attacker embeds malicious instructions in GitHub pull request titles, issue descriptions, or review comments that are processed by AI coding agents running in GitHub Actions without proper input sanitization. The agent executes the injected instructions and leaks credentials (ANTHROPIC_API_KEY, GITHUB_TOKEN, etc.) back via PR comments or external exfiltration channels. Rated CVSS 9.4 Critical for affected agents.
Mitigation: Sanitize all GitHub event inputs (PR titles, issue bodies, comments) before including in agent prompts; use input allowlists for agent task context; run CI/CD AI agents with minimal token scopes; require human review before agent-generated PR comments; use OIDC tokens with short TTLs instead of long-lived PATs; monitor for unexpected credential usage patterns in CI/CD logs
T026
Three chained vulnerabilities in Claude.ai enable an attacker to silently hijack a user's active chat session and exfiltrate all conversation data with a single click. The attack chains: (1) hidden prompt injection embedded in a crafted Claude URL, (2) open redirect on claude.com that makes the URL appear fully legitimate, (3) Google Ads hostname-based URL validation bypass that lets attackers place paid search ads displaying a trusted claude.com URL that invisibly redirects to the malicious injection URL. No additional tools, integrations, or user error beyond clicking the ad is required.
Mitigation: Do not click AI tool links from search ads — navigate directly by typing the URL; Anthropic patched the open redirect; share no secrets or credentials in Claude.ai web sessions; use Claude Code (native CLI) rather than browser-based sessions for sensitive work; enable browser security features that warn on redirects
T027
Supply chain attack that exploits Claude Code's persistent memory files to inject backdoor instructions that survive across all projects, sessions, and system reboots. The attacker uses a compromised dependency or repository as initial access, then tampers with the agent's CLAUDE.md, MEMORY.md, or equivalent memory files to append persistent malicious instructions and shell aliases. The poisoned memory frames insecure practices as required architectural standards, making the compromise self-sustaining and hard to detect.
Mitigation: Audit CLAUDE.md and MEMORY.md files before and after opening new repositories; treat memory files as security boundaries — apply the same review rigor as code; use git hooks to alert on modifications to .claude/ directory; scan all CLAUDE.md changes for shell commands, URLs, and outbound exfiltration patterns; consider CLAUDE.md hashing and re-verification before each session; run claude-code with --no-memory flag for untrusted workspaces
T028
Attacker embeds malicious instructions in files that an AI coding tool reads automatically — repository READMEs, source code comments, or documentation files — that cause the AI to write binary payloads or configuration backdoors to the developer's machine without any user interaction. Unlike social engineering attacks, the compromise triggers the moment the AI processes the poisoned file, with no additional steps required. Vendor confirmation: Cursor CLI, AWS Kiro, Codex Desktop App all confirmed vulnerable.
Mitigation: Disable auto-approve for file writes in all AI coding IDEs; never open untrusted repositories without reviewing markdown and documentation files first; audit .vscode/tasks.json and shell init files after opening any new repo; use workspace isolation (containers, VMs) for unfamiliar codebases; apply strict file-write allowlists in IDE settings
T029
Attacker compromises a dependency in the developer's supply chain that overwrites or modifies the AGENTS.md file in the agent's working environment. Since AI agents (particularly OpenAI Codex and compatible tools) read AGENTS.md as authoritative instruction context, the poisoned file injects attacker-controlled instructions into every future agent session using that workspace. The attack extends traditional supply chain compromise beyond code execution to persistent agent instruction poisoning — a malicious package that runs no exploits but simply overwrites a configuration file achieves persistent agent control.
Mitigation: Treat AGENTS.md as a security boundary — apply the same review process as code; use git hooks or file integrity monitoring to alert on AGENTS.md modifications; lock AGENTS.md permissions to prevent writes by dependency post-install scripts; audit AGENTS.md after every dependency install or update; apply the same defenses as T027 (Claude Code Memory Poisoning) to all agent instruction files
T024
Malicious or compromised browser extensions silently intercept and exfiltrate conversations between developers and AI coding assistants (Claude, Copilot, Cursor, ChatGPT). Unlike prompt injection (which manipulates the agent), prompt poaching passively captures every question, code snippet, API key, environment variable, and confidential document shared in the AI chat session — without requiring any mistake by the developer.
Mitigation: Audit installed browser extensions and remove any with unnecessary permissions to read all page data; use AI coding tools via native desktop app rather than browser when handling sensitive code; never share API keys, credentials, or secrets in AI chat sessions; treat browser-based AI conversations as potentially intercepted; implement DLP policies for AI tool usage
T031
Attacker embeds hidden malicious instructions in seemingly innocuous documents (employee onboarding PDFs, shared spreadsheets, web pages) that users upload to MCP-enabled AI assistants during normal workflows. When the AI processes the poisoned file, the hidden instructions direct it to silently access connected MCP-linked systems (databases, CRM, file shares) and exfiltrate sensitive data. No user interaction beyond uploading the document is required — the attack chain completes invisibly, with exfiltration traffic blending into normal agent data access patterns that would appear legitimate to security monitoring teams.
Mitigation: Apply content scanning to all documents before processing with MCP-enabled AI assistants; treat uploaded documents as potentially adversarial — never grant AI assistants permissions to access sensitive data based solely on instructions in uploaded files; implement DLP policies on MCP-connected AI outputs; require human approval for data export operations initiated by document-processing tasks; use Operant AI or equivalent runtime guardrails that detect unexpected data access during document analysis workflows
T030
Attacker places a malicious repository (e.g., on GitHub) containing crafted JSON configuration files in standard AI coding agent locations (.claude/settings.json, .mcp.json, .cursor/mcp.json). When a developer clones the repo and accepts the workspace folder trust prompt — a standard IDE dialog that defaults to 'Accept' on Enter — the malicious config automatically enables all project MCP servers, spawns an attacker-controlled server as an OS process with full developer privileges, and establishes a long-lived command-and-control channel or embeds a persistent payload. The attack is silent, requires only one Enter keypress, and works against Claude Code, Gemini CLI, Cursor CLI, and GitHub Copilot CLI.
Mitigation: Anthropic declined to fix (considers folder trust consent sufficient) — apply defense-in-depth: review .claude/settings.json, .mcp.json, and .cursor/mcp.json before accepting folder trust on any cloned repo; never press Enter on the folder trust dialog without first inspecting all AI agent config files in the repository root; disable auto-approve / YOLO mode globally; run unknown repos in isolated containers or VMs; use file integrity monitoring on AI agent config locations
T032
Attacker embeds hidden instructions in AI coding agent configuration files (CLAUDE.md, .cursorrules, AGENTS.md, MEMORY.md) using zero-width Unicode characters (U+200B Zero Width Space, U+200C Zero Width Non-Joiner, U+200D Zero Width Joiner, U+FEFF BOM/Zero Width No-Break Space). These characters render as completely invisible in standard text editors, code review tools, and GitHub diffs, but are faithfully read and executed by AI agents when they load the config file. First documented at scale in the Miasma Worm (June 2026), which used this technique to persist malicious instructions across supply chain compromise of npm packages and GitHub repositories.
Mitigation: Audit all AI agent config files for zero-width Unicode after dependency installs or repo clones; add pre-commit hooks that reject config file changes containing zero-width Unicode; use file integrity monitoring on CLAUDE.md, .cursorrules, and AGENTS.md; run 'cat -A CLAUDE.md' to reveal hidden characters before trusting config files; consider CLAUDE.md hashing and re-verification at session start
T033
Attacker harvests a public write-only Sentry DSN (leaked in exposed frontend JS or found via GitHub code search) and crafts malicious Sentry error events. When a developer asks their AI coding agent to 'fix the Sentry errors', the agent reads the injected event content as a legitimate diagnostic instruction and executes attacker-controlled code. Bypasses EDR/WAF/IAM because every step in the chain looks authorized — the agent is doing exactly what it was asked to do, just on poisoned input.
Mitigation: Rotate exposed write-only DSNs; do not grant coding agents unreviewed access to third-party error-tracking data; require human confirmation before agents act on 'fix this error' prompts sourced from external diagnostic tools
T034
Attacker publishes a repository containing an innocent-looking file (e.g. project_settings.json) that is actually a symbolic link to a sensitive location on the victim's machine (e.g. ~/.ssh/authorized_keys or an AI-agent config directory). When the developer asks the coding assistant to set up or configure the project, the agent follows the symlink and writes attacker-supplied content there — for example a public SSH key granting persistent passwordless access — while the human-in-the-loop confirmation dialog displays only the benign in-project path. The approval UI shows the wrong file, so the developer approves a write they never intended.
Mitigation: Update affected agents (Amazon Q language server >= 1.69.0, Cursor >= 3.0, Antigravity >= 1.19.6); never approve agent file writes to symlinked paths; verify the real resolved path shown in approval dialogs; run untrusted repos in isolated containers
T035
Structural class flaw, not a single CVE: an AI coding agent gates shell execution by matching the raw command string against a denylist/allowlist, but bash later rewrites and evaluates that same text through expansion, substitution, and quote handling. Any rewrite that survives the text matcher yet is bash-equivalent to a blocked pattern is a bypass. Because the guard checks pre-expansion text while bash executes post-expansion, decades-old shell-evasion techniques (variable/brace/command substitution, quote splitting, IFS tricks) defeat the guard. Adding more denylist patterns does not fix it — the agent-to-bash-gated-by-string-matching convention fails by design.
Mitigation: Do not rely on string-matching command guards. Enforce at the OS/kernel layer instead: run the agent's shell in a sandbox (container, seccomp, restricted syscalls), drop network egress by default, and mediate execution through an allowlisted interpreter rather than pattern-matching raw text. Prefer agents with guard-by-architecture (e.g. Continue) over denylist agents
T036
Indirect prompt injection where the malicious payload never exists in the repository itself. A clean-looking repo ships (1) a README with normal setup steps, (2) a deliberately failing Python package that nudges the user/agent to run an initialization command, and (3) a setup script that fetches a base64-encoded payload from an attacker-controlled DNS TXT record, decodes it, and executes it. When an AI coding agent tries to resolve the setup errors autonomously, it runs the script and spawns a fully interactive reverse shell with the developer's own privileges. Because the payload arrives dynamically from DNS at runtime, static code review and repo scanners see nothing malicious.
Mitigation: Do not let coding agents auto-run setup/init commands from untrusted repos; block agent egress DNS/HTTP to non-allowlisted hosts during setup; run unknown repos in network-isolated sandboxes; require human review before executing any repo-provided initialization script
T037
Prompt injections hidden inside third-party library documentation steer an AI coding agent into executing an attacker-controlled binary while the agent is performing an automated security review or dependency audit. The attack exploits the agent's inability to distinguish untrusted data sources (library docs it reads to 'understand' a dependency) from safe instructions, turning a defensive review task into arbitrary code execution.
Mitigation: Never grant review/audit agents unrestricted execution; run dependency reviews read-only in a sandbox with no network egress and no exec; keep a hard boundary between 'analyze this text' and 'run this command'
T038
AI coding agents hallucinate plausible-looking but nonexistent package names during code completion or dependency-suggestion. Attackers monitor which names models repeatedly invent, pre-register those exact names on public package registries with malicious payloads, then wait: when the same agent later suggests 'install X' to a different developer, the suggestion looks legitimate and the developer approves the install, running the malware with normal trust.
Mitigation: Require human review before installing any agent-suggested dependency not already in the project's lockfile; check package registration date and maintainer reputation before approving 'install X' suggestions; prefer agents/IDE integrations that verify a package exists and has install history before suggesting it
T039
A repository ships a .claude/settings.json with a startup hook, or a .vscode/tasks.json with runOn: folderOpen. Cloning the repo and opening it in the agent or the editor executes attacker code before the developer types anything. No package install, no tool call, no prompt is required, so package-manager hardening does not apply.
Mitigation: Read repo-provided agent and editor config before opening the folder, the same way you would read a CLAUDE.md. Keep workspace trust enabled, it is the only native control on this path. Do not let host tooling auto-run files an agent wrote inside its own sandbox.
T040
Malware that has stolen a GitHub token commits under an AI coding agent's identity, so its repository writes blend into the commit history of teams that already let agents commit. Commit authorship, normally a first-line detection signal, stops discriminating.
Mitigation: Require signed commits for agent identities so an unsigned commit under an agent's name is anomalous by construction. Enable branch protection so a stolen token cannot write to every branch. Alert on commits to more than N branches within a short window.
T041
The attacker does not need to address the agent directly. They arrange for attacker-controlled text to land in a log, alert or diagnostic record that the agent will later inspect. This is indirect prompt injection through observability data: the model receives a prompt, but the malicious instructions arrive through tool output that operators may incorrectly treat as trusted.
Mitigation: Deny outbound network access by default. Require human approval per command, not per session. Never let a tool's output drive command execution. Scope API keys so the agent cannot touch DNS, email routing or infrastructure writes unless that specific task requires it. Rotate and scope the client-side keys (Datadog client tokens, Sentry DSNs) that let anyone write into your telemetry in the first place.
T042
The skill's entry file is clean. Malicious instructions live in a secondary file that the agent only loads when it reaches a specific step, exploiting progressive disclosure, the context-window technique where an agent reads supporting files on demand rather than all at once. A reviewer reading SKILL.md, and a scanner parsing it, both see nothing.
Mitigation: Treat every file a skill can reach as part of its attack surface. In review, follow each reference the way the agent would. Pin the reviewed commit or digest, not a mutable tag, slug, or marketplace name. Re-review before changing the pin.
T043
When an agent's allowlist trusts a bare hostname, any public counter on that domain becomes a covert channel. The attacker creates one resource per possible character, has the agent fetch the one matching the next character of a secret, and reads the secret back one increment at a time from the public counter. No outbound connection to attacker infrastructure ever occurs: every request goes to a domain the operator deliberately trusted.
Mitigation: Never allowlist a bare hostname on a domain where third parties can create content and observe metrics. Scope allowlist entries to specific paths. Audit existing allowlists for this property now: package registries, model hubs, gists, paste sites and issue trackers all qualify.
Recent feed events, ordered by their canonical event date. Detection coverage remains explicit for each record.
A webview using non-file resource schemes can exploit inconsistent separator handling to read content outside the extension's allowed resource roots.
Detector coverage: not_detected
Repository settings can redirect authenticated Azure DevOps Code Search requests to an attacker endpoint and expose the user's token.
Detector coverage: not_detected
Rendering agent-provided remote media can initiate a request before the chat policy removes the element, potentially leaking data encoded in its URL, including on history restoration.
Detector coverage: not_detected
Agent web and browser tools can bypass denied destinations through inconsistent URL parsing or ignored valid administrator patterns when network filtering is enabled.
Detector coverage: not_detected
With agent filtering and browser chat tools enabled, URL separator interpretation differs between policy validation and browser navigation, permitting requests to restricted hosts.
Detector coverage: not_detected
Installing or updating attacker-controlled MCP gallery metadata can write beyond per-server storage; uninstalling the entry can delete an unintended directory.
Detector coverage: not_detected
An untrusted workspace can connect to attacker-controlled services and bypass restrictions without the user granting workspace trust.
Detector coverage: not_detected
With agent filtering enabled, an IPv4 deny entry and an empty allow list, an equivalent mapped IPv6 address can bypass the denied destination.
Detector coverage: not_detected
Workspace settings can choose a remote agent host and grant it local-file access, enabling data access or code execution when the crafted repository is opened.
Detector coverage: not_detected
Restricted workspace settings expressed as nested objects can take effect without workspace trust, allowing settings intended to remain blocked.
Detector coverage: not_detected
The September CVE publication records an earlier maintainer disclosure. SSE deployments are affected; default stdio is excluded.
Detector coverage: not_detected
The September GitSpawn review adds the July Goose advisory to AgentSec. Exposure requires attacker-controlled Git configuration already present on disk.
Detector coverage: not_detected
Campaign records preserve their reported date and source. “Active” describes the tracked campaign collection, not a claim that every campaign is active today.
Atomic Stealer (AMOS) + Windows infostealers
Tracked across ClawHub, skills.sh.
Spawns /bin/sh -i reverse shell before starting MCP server
Copies official Postmark MCP server with hidden backdoor
Prompt injection via GitHub issue title → GitHub Actions cache poisoning (10 GB junk fill, LRU eviction) → stolen CI/CD publishing tokens → malicious npm publish
GhostLoader RAT
Stealth Packer + GhostSocks
After OpenClaw integrated VirusTotal scanning, attackers pivoted to hosting malware on lookalike OpenClaw websites; skills are used as decoys with no embedded payload (passing VirusTotal clean), but direct victims to attacker-controlled lookalike domains for 'installation prerequisites'. Bypasses hash-based scanning entirely.
Obfuscated JavaScript infostealer
Arbitrary malware from attacker-controlled URL
No traditional malware — JavaScript-based agent co-option for cryptocurrency mining
Threat actors abuse both Hugging Face model/dataset files and ClawHub skills to distribute malware by injecting indirect prompts into malicious files; AI agents that read these files during development or model evaluation tasks execute the injected instructions, triggering malware installation or credential exfiltration; extends the supply chain attack surface from traditional package registries to ML model repositories
Four chained vulnerabilities (TOCTOU sandbox write escape, TOCTOU sandbox file read, shell allowlist bypass, and owner-level privilege escalation) that can be combined to achieve stealthy full-host compromise starting from a single malicious plugin or prompt injection inside the OpenClaw sandbox. Chain: (1) initial foothold via malicious plugin or prompt injection; (2) CVE-2026-44113 + CVE-2026-44115 to read sensitive credentials and files outside the sandbox; (3) CVE-2026-44118 to escalate to owner-level control; (4) CVE-2026-44112 to write backdoors and establish persistence outside the sandbox.
Various malware + cryptocurrency scams
First confirmed self-replicating supply chain worm targeting AI coding agent configuration files. Injects hidden instructions using zero-width Unicode characters (U+200B, U+200C, U+FEFF) into CLAUDE.md and .cursorrules files — invisible to human code reviewers but executed by AI agents on next session load. Captures SSH keys, AWS credentials, GitHub tokens, and cryptocurrency keystores then exfiltrates to TeamPCP C2 infrastructure (83.142.209.0/24, Megalodon C2 at 216.126.225.129:8443).
First documented case of an AI agent used operationally in a supply chain attack: payload included 'hackerbot-claw', an AI agent built on OpenClaw that performed automated reconnaissance and lateral movement targeting Kubernetes clusters. TeamPCP first compromised Trivy (a security tool) to obtain PyPI credentials — poisoning a security scanner to attack downstream users.
Tracked across npm / GitHub.
Tracked across skills.sh (Vercel) primary; npm and PyPI secondary; GitHub releases for payload hosting.
Filter the complete server-rendered catalogue. Search and type controls enhance the page but are not required to read the records.
145 results
A webview using non-file resource schemes can exploit inconsistent separator handling to read content outside the extension's allowed resource roots.
Repository settings can redirect authenticated Azure DevOps Code Search requests to an attacker endpoint and expose the user's token.
Rendering agent-provided remote media can initiate a request before the chat policy removes the element, potentially leaking data encoded in its URL, including on history restoration.
Agent web and browser tools can bypass denied destinations through inconsistent URL parsing or ignored valid administrator patterns when network filtering is enabled.
With agent filtering and browser chat tools enabled, URL separator interpretation differs between policy validation and browser navigation, permitting requests to restricted hosts.
Installing or updating attacker-controlled MCP gallery metadata can write beyond per-server storage; uninstalling the entry can delete an unintended directory.
An untrusted workspace can connect to attacker-controlled services and bypass restrictions without the user granting workspace trust.
With agent filtering enabled, an IPv4 deny entry and an empty allow list, an equivalent mapped IPv6 address can bypass the denied destination.
Workspace settings can choose a remote agent host and grant it local-file access, enabling data access or code execution when the crafted repository is opened.
Restricted workspace settings expressed as nested objects can take effect without workspace trust, allowing settings intended to remain blocked.
The September CVE publication records an earlier maintainer disclosure. SSE deployments are affected; default stdio is excluded.
The September GitSpawn review adds the July Goose advisory to AgentSec. Exposure requires attacker-controlled Git configuration already present on disk.
Manifold reports Git configuration execution during agent context collection. The September 1 patch-status snapshot needs vendor follow-up; no current fixed floor is inferred for its unresolved variants.
September database publication adds package ranges for a June advisory. It concerns a bypass of an earlier external-reference SSRF fix.
AWS disclosed a generator defect triggered by untrusted data-model names. Exposure requires generating and deploying the resulting application.
Anthropic documents additional security fixes through 2.1.269. This release-note review does not establish remediation of the withheld GitSpawn variant.
A GitHub security advisory and CVE-2026-53965 described an unbounded in-memory buffer in the HttpTransport component of the official Model Context Protocol PHP SDK (Composer package mcp/sdk). Versions 0.5.0 through 0.7.0 appended every incoming Server-Sent Events chunk to a buffer with no upper bound and only flushed it on the SSE event delimiter, so a malicious, compromised, or man-in-the-middle MCP server that withheld the delimiter could exhaust the client process's memory and deny service. Fixed in mcp/sdk 0.7.1.
Varonis Threat Labs disclosed CVE-2026-24301, a chain of three vulnerabilities in Microsoft Copilot Personal: an undocumented ?autorun=1 URL parameter that executes an attacker-supplied prompt on page load, exfiltration of data from connected OAuth apps through Copilot's own URL-fetch tool, and persistent memory poisoning via web summarization. Microsoft shipped a server-side fix the same day the issue was disclosed. Varonis reports no evidence of pre-patch exploitation.
A repository security advisory and CVE-2026-82233 described a path traversal vulnerability in the asset.upload MCP tool shipped by the SiYuan note-taking application. Versions before 3.8.1 accepted arbitrary absolute file paths without a workspace boundary check, so a prompt-injected instruction to the built-in AI agent could copy files such as SSH keys or credentials from outside the workspace into the asset directory. Fixed in SiYuan 3.8.1.
Tenet reports demonstrations where attacker-controlled log and telemetry content influenced agents that held privileged tools. Reported success rates, detection outcomes, and organization counts are Tenet's claims and are not independent measurements by AgentSec.
Zenity documents AI Total for dynamic skill evaluation. Tenet publishes agent-jackstop as a public reference repository, but AgentSec found no visible software license and does not classify it as open source.
Zenity reported Paperclip and Browser Use typosquats that accumulated reputation while clean and later directed agents to fetch external payloads. The reported install count is aggregate and is not a victim count.
AgentSec preserves JFrog and SafeDep reporting for @keyv/*@6.0.0 as contested intelligence instead of promoting the wildcard package scope to critical and confirmed.
Security researchers reported malicious npm package versions associated with the August 2026 Shai-Hulud campaign. AgentSec treats exact confirmed package/version and payload-hash matches as incident-response evidence.
GitHub Advisory Database records five MCP Ruby SDK vulnerabilities fixed in mcp gem 0.23.0. The set covers session ownership, request and line limits, DNS-rebinding protection, and session retention.
Perplexity describes Numbat as a local monitor for supported agent event streams, with 52 CEL rules in the reviewed release and enforcement that must be enabled explicitly.
NVD records that a crafted .gemini/.env file could execute commands on a headless CI host before sandbox initialization. The affected version floors cover both Gemini CLI and the run-gemini-cli GitHub Action.
Anthropic reported that a pre-approved Hugging Face hostname allowed attacker-controlled paths to act as an out-of-band data channel when untrusted content reached Claude Code context. The maintainer identifies 2.1.163 as the first patched release.
Atomic Stealer (AMOS) + Windows infostealers · ClawHub / OpenClaw
ClawHub · skills.sh
Spawns /bin/sh -i reverse shell before starting MCP server · PyPI
Copies official Postmark MCP server with hidden backdoor · npm
Prompt injection via GitHub issue title → GitHub Actions cache poisoning (10 GB junk fill, LRU eviction) → stolen CI/CD publishing tokens → malicious npm publish · GitHub Actions / npm
GhostLoader RAT · Malicious npm package posing as official OpenClaw AI installer; postinstall hook triggers GhostLoader; installs persistent RAT with SOCKS5 proxy and live browser session cloning; clipboard monitoring every 3 seconds for crypto addresses, API keys (AWS, OpenAI, Anthropic) · npm
Stealth Packer + GhostSocks · Fake OpenClaw installers distributed via malicious GitHub repositories; AI-generated search results (Bing) inadvertently recommended malicious repos to users searching for OpenClaw; installers deploy Stealth Packer malware and GhostSocks which resets firewall protections to route traffic through compromised systems while evading anti-fraud protections and MFA · GitHub repositories
After OpenClaw integrated VirusTotal scanning, attackers pivoted to hosting malware on lookalike OpenClaw websites; skills are used as decoys with no embedded payload (passing VirusTotal clean), but direct victims to attacker-controlled lookalike domains for 'installation prerequisites'. Bypasses hash-based scanning entirely. · ClawHub / OpenClaw
Obfuscated JavaScript infostealer · Fraudulent website imitating official OpenClaw site (app-clawbot[.]org) uses ClickFix social engineering to trick users into running a highly obfuscated JavaScript infostealer; malware profiles systems and exfiltrates hostname, Windows version, CPU architecture, installed memory, uptime, and system language to C2 servers · Fake website / social engineering
Arbitrary malware from attacker-controlled URL · At least 39 malicious skills abuse SKILL.md setup instructions to prompt installation of fake OpenClawCLI prerequisites from openclawcli.vercel.app; users following setup instructions download and execute attacker-controlled payloads · ClawHub / SKILL.md
No traditional malware — JavaScript-based agent co-option for cryptocurrency mining · 30 skills published by a single author silently register AI agents at onlyflies.buzz to participate in a coordinated $FLY token cryptocurrency mining operation; no malware dropper, no user consent, no traditional IOCs — agents become mining nodes through skill-injected instructions that commandeer agent compute resources; bypasses traditional AV and malware detection since no binary payload is deployed · ClawHub / OpenClaw
Threat actors abuse both Hugging Face model/dataset files and ClawHub skills to distribute malware by injecting indirect prompts into malicious files; AI agents that read these files during development or model evaluation tasks execute the injected instructions, triggering malware installation or credential exfiltration; extends the supply chain attack surface from traditional package registries to ML model repositories · Hugging Face / ClawHub
Four chained vulnerabilities (TOCTOU sandbox write escape, TOCTOU sandbox file read, shell allowlist bypass, and owner-level privilege escalation) that can be combined to achieve stealthy full-host compromise starting from a single malicious plugin or prompt injection inside the OpenClaw sandbox. Chain: (1) initial foothold via malicious plugin or prompt injection; (2) CVE-2026-44113 + CVE-2026-44115 to read sensitive credentials and files outside the sandbox; (3) CVE-2026-44118 to escalate to owner-level control; (4) CVE-2026-44112 to write backdoors and establish persistence outside the sandbox. · OpenClaw
Various malware + cryptocurrency scams · ClawHub / OpenClaw
First confirmed self-replicating supply chain worm targeting AI coding agent configuration files. Injects hidden instructions using zero-width Unicode characters (U+200B, U+200C, U+FEFF) into CLAUDE.md and .cursorrules files — invisible to human code reviewers but executed by AI agents on next session load. Captures SSH keys, AWS credentials, GitHub tokens, and cryptocurrency keystores then exfiltrates to TeamPCP C2 infrastructure (83.142.209.0/24, Megalodon C2 at 216.126.225.129:8443). · npm / GitHub
First documented case of an AI agent used operationally in a supply chain attack: payload included 'hackerbot-claw', an AI agent built on OpenClaw that performed automated reconnaissance and lateral movement targeting Kubernetes clusters. TeamPCP first compromised Trivy (a security tool) to obtain PyPI credentials — poisoning a security scanner to attack downstream users. · PyPI
npm / GitHub
skills.sh (Vercel) primary; npm and PyPI secondary; GitHub releases for payload hosting
40+ malicious skills, programmatic malware campaign, clawhub/clawdhub1 typosquats
Malicious crypto/trading skills, typosquatted exchange tools
Unicode-obfuscated instructions, DAN-style jailbreaking for exfiltration
Mixed prompt-injection + exfil; GitHub repo aztr0nutzs/NET_NiNjA.v1.2 hosts additional weaponized skills
677 malicious skills (updated June 2026; previously 354 at March 2026); all confirmed malicious by VirusTotal scan; malware disguised as productivity/utility tools across all ClawHub categories; most prolific single attacker in ClawHavoc campaign
199 malicious skills submitted via automation (one skill every few minutes); contributed to ClawHavoc campaign expansion from 341 to 1,184+ confirmed malicious entries by March 1, 2026
typosquatting record from Snyk ToxicSkills
typosquatting record from Snyk ToxicSkills
typosquatting record from Snyk ToxicSkills
Typosquatting + credential theft
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
33 variants (solana-07bcb through solana-ytzgw), deploys AMOS
29 variants (phantom-0jcvy through phantom-ygmjc), deploys AMOS
25 variants (wallet-tracker-0ghsk through wallet-tracker-zih4w)
23 variants (insider-wallets-finder-1a7pi through insider-wallets-finder-zzs2p)
14 variants
malware record from Koi ClawHavoc
malware record from Koi ClawHavoc
malware record from Koi ClawHavoc
29 variants, deploys AMOS
13 variants
13 variants
malware record from Koi ClawHavoc
malware record from Koi ClawHavoc
malware record from Koi ClawHavoc
malware record from Koi ClawHavoc
30 variants (polymarket-25nwy through polymarket-z7lwp)
malware record from Koi ClawHavoc
malware record from Koi ClawHavoc
malware record from Koi ClawHavoc
27 variants (auto-updater-161ks through auto-updater-xsunp)
24 variants
25 variants
17 variants targeting Gmail/Calendar/Drive
Fake auth tool dropping separate payload
Fake auth tool dropping separate payload
Reverse shell to 54.91.154.110:13338 via /bin/bash -i >/dev/tcp/...
Reverse shell to 54.91.154.110:13338
Reads ~/.clawdbot/.env, POSTs to webhook.site/358866c4-81c6-4c30-9c8c-358db4d04412
Reverse shell to 45.115.38.27:4433 before starting MCP server
Reverse shell to 45.115.38.27:4433
Reverse shell to 45.115.38.27:4433
Squatter copying official Postmark MCP with hidden backdoor
GhostLoader RAT — persistent daemon, SOCKS5 proxy, live browser session cloning, clipboard monitor (every 3s for private keys/API keys), steals credentials/SSH keys/Apple Keychain/iMessage; 178 downloads before discovery; uploaded 2026-03-03
~50,000 downloads; uses evasion techniques to avoid detection; targets developer machines with malware delivery
Malicious version live ~40 minutes on 2026-03-24 (10:39 UTC); TeamPCP obtained PyPI credentials via prior compromise of Trivy CI/CD security scanner; contains multi-stage payload: credential harvest + Kubernetes lateral movement + persistent systemd backdoor; includes hackerbot-claw using OpenClaw for automated attack targeting — first AI agent used operationally in a supply chain attack; 3.4M daily downloads at time of attack; affects CrewAI, DSPy, Microsoft GraphRAG, and dozens of other AI agent frameworks
Second malicious version in same TeamPCP attack window (same payload as 1.82.7); both quarantined by PyPI after ~40 minutes; tracked as sonatype-2026-001357
Runtime agentic affiliate injection targeting financial-advice communities; manipulates the agent's recommendations to redirect users toward attacker-controlled affiliate links
Agentic front-running scheme; coordinates Solana meme-token pooling via the agent to manipulate token prices
AMOS dropper hidden in a README.md padded to ~22M characters to exceed automated scanner size thresholds; SHA256 b30eaed1f7478c28f4ec50d07ed5ef014ffbc4b2bc5a38d689ba9f7abb5e19c2; originally found by JFrog, re-analyzed and republished by Unit 42
Poses as a TradingView trading assistant; delivers a macOS infostealer tracked as 'cluw'
Companion skill to ai-tradingview-assistant-for-macos; same 'cluw' macOS infostealer payload
Patient zero, 604M installs/month. Maintainer's GitHub account (jaredwray) taken over; malicious files pushed to main, then the project's own GitHub Actions release workflow published the package with VALID OIDC + SLSA provenance. Adds 'preinstall': 'node setup.mjs'. Safe version: 5.6.0
580M installs/month; same preinstall dropper as keyv@6.0.0
571M installs/month; transitive dependency of ESLint toolchains
137M installs/month
30M installs/month
16M installs/month
28M installs/month
34M installs/month
6M installs/month
Published in the 10:09:44-10:14:41 UTC burst with the rest of the cacheable family
Same maintainer as keyv/cacheable
Storage adapters compromised at 6.0.0: @keyv/dynamo, @keyv/mongo, @keyv/memcache, @keyv/valkey, @keyv/test-suite, plus Redis/Postgres/SQLite/MySQL/Etcd/compression drivers. CONTESTED: The Hacker News reported the @keyv/* adapters stayed clean; JFrog's affected-package table and SafeDep's CSV both list them at 6.0.0. Treat as compromised.
Worm propagation phase, republished with a stolen npm token
Worm propagation phase
Worm propagation phase
Worm propagation phase
Worm propagation phase, Qlik-maintained charting library
Typosquat of the legitimate paperclipai/paperclip. Skill instructions told the agent to skip npm and npx and fetch a binary straight from an attacker-controlled GitHub release, which loaded a credential stealer. The malicious install steps sat in a secondary setup-installation.md so they only surfaced when the agent actually needed to install or start Paperclip.
Typosquat of browser-use/browser-use. A lure skill whose whole purpose was instructing the agent to pip install the poisoned PyPI package below.
Browser Harness plus an added helpers.py holding the infostealer. Importing the helper ran the credential search and posted results to api[.]getpaperclipp[.]com/feedback. PyPI caught it within two hours on 2026-07-13, which is why the operators pivoted to serving payloads from GitHub releases instead.
Same infostealer, same exfiltration endpoint. Four independent triggers were recovered: Python import, CLI execution, package postinstall during Paperclip installation, and log_action during Paperclip API use. 'I never ran the CLI' does not rule out execution.
Change the search or reset the type filter.
Dates describe the source record. Recheck the linked source before acting on time-sensitive risk information.
