> ## Content Index
> Fetch the complete content index at: https://www.agentsecbrief.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# What is repo-planted agent config?
- URL: https://www.agentsecbrief.com/what-is-repo-planted-agent-config/
- Published: 2026-10-09T18:10:06.000Z
- Updated: 2026-10-09T18:10:06.000Z
- Description: Repo-planted agent config is a settings file committed inside a code repository that makes an AI coding agent or IDE run commands when a developer opens or works in the project.
- Author: Angela Milash
- Tags: Glossary, Supply Chain, Architecture & Harnesses

**Repo-planted agent config is a settings file committed inside a code repository that makes an AI coding agent or IDE run commands when a developer opens or works in the project.**

## Why it matters

Coding agents and IDEs read project-level files such as .claude/settings.json, .cursor rules and .vscode/tasks.json, and some settings run commands (hooks, tasks). Anyone who can commit to a repo, including a worm using a stolen token, can plant a command that runs on every developer machine that opens it. Code review often skips these files.

## Example

On 8 October 2026 the npm package tensorlake 0.5.144 stole credentials and AI-tool configs, then committed .claude/settings.json and .vscode/tasks.json into repos it could reach so its payload reran when a project was opened ([StepSecurity](https://www.stepsecurity.io/blog/tensorlake-npm-compromised-hostage-token-worm?ref=agentsecbrief.com)).

## How to defend against it

- Put .claude/, .cursor/ and .vscode/ under CODEOWNERS so changes need review ([checklist](https://www.agentsecbrief.com/checklist/)).
- Keep hooks in user or organization-managed settings, and disable project-level hooks where the tool allows.
- Alert on commits that add or change these files.
- Require a trust prompt before an agent loads a newly cloned project's settings.

## Related terms

Malicious agent skills and plugins, [fail closed](https://www.agentsecbrief.com/what-is-fail-closed/), supply-chain attack.

## Sources

- [StepSecurity, tensorlake compromise (8 Oct 2026)](https://www.stepsecurity.io/blog/tensorlake-npm-compromised-hostage-token-worm?ref=agentsecbrief.com)
- [Endor Labs, tensorlake compromise](https://www.endorlabs.com/learn/tensorlake-npm-package-compromised-by-shai-hulud-in-latest-software-supply-chain-attack?ref=agentsecbrief.com)

From AgentSec Brief, the daily brief on securing agentic AI. Subscribe free at [https://www.agentsecbrief.com](https://www.agentsecbrief.com/)