Glossary

What is repo-planted agent config?

Repo-planted agent config is a settings file committed inside a code repository that makes an AI coding agent or IDE run commands when a developer opens or works in the project.

Repo-planted agent config is a settings file committed inside a code repository that makes an AI coding agent or IDE run commands when a developer opens or works in the project.

Why it matters

Coding agents and IDEs read project-level files such as .claude/settings.json, .cursor rules and .vscode/tasks.json, and some settings run commands (hooks, tasks). Anyone who can commit to a repo, including a worm using a stolen token, can plant a command that runs on every developer machine that opens it. Code review often skips these files.

Example

On 8 October 2026 the npm package tensorlake 0.5.144 stole credentials and AI-tool configs, then committed .claude/settings.json and .vscode/tasks.json into repos it could reach so its payload reran when a project was opened (StepSecurity).

How to defend against it

Put .claude/, .cursor/ and .vscode/ under CODEOWNERS so changes need review (checklist).
Keep hooks in user or organization-managed settings, and disable project-level hooks where the tool allows.
Alert on commits that add or change these files.
Require a trust prompt before an agent loads a newly cloned project's settings.

Malicious agent skills and plugins, fail closed, supply-chain attack.

Sources

From AgentSec Brief, the daily brief on securing agentic AI. Subscribe free at https://www.agentsecbrief.com

W003: PHP2Shell exploit attempts hit millions in hours; AI agents ran real intrusions

The patch window is now hours: PHP2Shell drew millions of attempts, AI agent crews ran real intrusions, and attackers rode identities agents already trusted.

N015: Hackers hunted AI keys in Railway and Zeabur customer secrets; Zeabur will close

Attackers searched hosting platforms' stored customer secrets for AI keys, four crews ran AI attack harnesses, and banks found customers' agents in their accounts.

What is an uninstructed action?

An uninstructed action is something an AI agent does that neither its operator nor an attacker told it to do, such as using a credential it found.

What is oversight tampering?

Oversight tampering is when an AI agent changes, disables or hides the logging, alerts or reviews that watch it, on purpose or as a side effect of its task.