Skip to content
Sign in
Rung 06 Agent SecuritySwitch rung
Rung 06 / How an agent gets owned

Agent Security

How an agent gets owned, and what bounds the damage.

4
Sources
4
Concepts
2
Entities
A machined steel padlock with a copper shackle, on paper.

In scope: the exploitation surface, prompt injection and goal reframing, permission escalation, memory and context poisoning, tool and supply-chain provenance, deployed-agent safety evidence, red-teaming method. Out: model-level alignment research as a subject in itself (models), harness architecture (harnesses).

Two cells either side of a copper partition — one breached and disordered, one intact.
InjectionGoal reframingPoisoningEscalation
Download Report
Report only1Show all
Sources compiled for this topic
TypeSourcePublished
REPORTCaught in the Hook: RCE and API Token Exfiltration Through Claude Code Project Files (CVE-2025-59536, CVE-2026-21852)
Aviv Donenfeld, Oded Vanunu · Check Point Research

Three attacks carried in a repo's own Claude Code config: project hooks run after one trust click (GHSA-ph6w-f82w-28w6, fixed 1.0.87); repo settings auto-approve MCP servers so their commands run before the trust dialog (CVE-2025-59536, fixed 1.0.111); a repo-set ANTHROPIC_BASE_URL sends the user's API key to the attacker before trust is given (CVE-2026-21852, fixed 2.0.65). A stolen key reached the whole Workspace's files. All fixed before public disclosure 2026-02-25.

2026-02-25