Researchers say attackers can abuse trusted-looking project files in code repositories to make AI coding agents install attacker-controlled components and run malicious code on a developer's machine or in continuous integration (CI) systems. Adversa's 'SymJack' technique uses disguised symbolic links (symlinks) and a copy command to silently register a malicious Model Context Protocol (MCP) server; the firm says it worked against Claude Code, Gemini CLI, Antigravity CLI, Cursor Agent CLI, Grok Build CLI, and GitHub Copilot CLI, and published a proof of concept on GitHub. Anthropic reportedly hardened Claude Code to resolve symlinks before approval and show the true destination path.
Why it matters: Teams using AI coding agents could unknowingly approve changes that steal SSH keys, cloud tokens, browser sessions, or CI secrets and then push malicious code downstream. This is urgent for developers and DevOps teams using agentic coding tools: review repository trust assumptions, restrict or audit MCP server registration, scrutinize file-copy prompts, and apply vendor mitigations where available.
Bill Toulas
2026.06.27
78% relevant
This article adds a specific Claude Code attack chain in which a benign-looking repository and setup error cause the agent to run an initialization command that fetches and executes attacker-controlled instructions from a DNS TXT record, extending the broader story of AI coding agents being manipulated through trusted project workflows.
info@thehackernews.com (The Hacker News)
2026.06.12
95% relevant
This appears to cover the same underlying event: a newly disclosed attack against AI coding agents that manipulates trusted project context to make agents execute attacker-controlled actions or install malicious components. The article uses the name 'Agentjacking,' but the core event matches the tracked story about AI coding agents such as Claude Code, Copilot CLI, and Gemini CLI being tricked into unsafe tool execution.
Kevin Townsend
2026.05.27
100% relevant
This article appears to be the initial reporting of the SymJack technique as a named, cross-vendor attack pattern with a public proof of concept and documented vendor responses.
← Back to all stories