Your AI Agent's Config Is Now the Payload How Attackers Are ...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://tenable.com/blog/ai-coding-assistant-agent-harness-attacks
• Blog Title: Your AI Agent's Config Is Now the Payload: How Attackers Are Targeting the Developer Agent Harness
• Suggested Section: AI Security > AI Coding Agent Harness Attacks and Persistent Prompt Injection

🎯 Content Summary

Published on July 21, 2026, this post analyzes an AI-agent harness attack observed in the Mini Shai-Hulud worm and its Miasma variant. Instead of leaving the payload only inside a malicious npm, PyPI, or other third-party registry package, the malware rewrites configuration and instruction files used by AI coding assistants. These files form a high-impact per...

🔧 Technical Details

Supply-chain infection followed by harness persistence: A malicious package lifecycle hook such as npm preinstall can be used only as the initial execution stage. Once active, malware can place a payload in a persistent user-controlled location, recursively discover AI-assistant configuration files, and modify the auto-run mechanisms that are triggered during future coding sessions. This moves persistence outside the package artifact and allows execution to continue even when defenders focus their inspection on the original dependency.

AI-agent startup-hook injection: When an AI coding tool permits commands in an event such as hooks.SessionStart, malware with filesystem access can parse the existing JSON and append a merge-safe hook instead of overwriting legitimate configuration. A wildcard hook containing "command": "bun run ~/.config/index.js" executes the staged JavaScript whenever a matching ses...

🤖 Agent Actions

Done — updated src/AI/AI-Prompts.md.

Added a new section covering:

• AI coding agent harness persistence
• SessionStart hook injection in Claude/Gemini settings
• Persistent prompt injection via .cursorrules, .windsurfrules, and .github/copilot-instructions.md
• Global Cursor .mdc abuse with alwaysApply: true + globs: ["**/*"]
• Clear-bomb / model-refusal evasion against LLM scanners

Also added the Tenable blog URL to the file’s ## References section.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://tenable.com/blog/ai-coding-assistant-agent-harness-attacks

Content Categories: Based on the analysis, this content was categorized under "AI Security > AI Coding Agent Harness Attacks and Persistent Prompt Injection".

Repository Maintenance:

• MD Files Formatting: 990 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0