Advisories
AI agent threats, explained clearly.
Real attacks against AI coding agents, MCP servers, and developer tools. Each advisory breaks down how the attack works, what to look for, and which Guard protections apply.
0
Supply-chain advisories
22
Curated patterns
6
Threat categories
14
Affected tools
Browse advisories
Click any advisory to see the full attack breakdown, detection steps, and Guard configuration.
npm postinstall script abuse in AI coding environments
Malicious npm packages use postinstall scripts to execute arbitrary code during installation. In AI coding environments, these scripts can modify agent configuration, install backdoor MCP servers, or exfiltrate project secrets — all before the developer reviews the package.
Read advisoryCI/CD pipeline poisoning via agent-written config
AI agents that write CI/CD configuration files (GitHub Actions, GitLab CI, CircleCI) can introduce backdoors — injecting steps that exfiltrate secrets, modify artifacts, or deploy malicious code — that execute on every build.
Read advisoryEnvironment file exfiltration via webhook
AI agents can be tricked into reading .env files and sending their contents to external endpoints through tool calls, webhook integrations, or HTTP requests that appear legitimate.
Read advisoryAgent identity spoofing via system prompt mimicry
Attackers can craft content that mimics system prompts or tool outputs, tricking the agent into believing it received instructions from the harness, the user, or a trusted tool — when the instructions actually came from untrusted data.
Read advisoryMalicious skill with hidden prompt injection
AI agent skills (Claude Code skills, Cursor rules, Copilot extensions) can contain hidden prompt injections in their instructions. When the skill is loaded, the hidden prompt executes on every session that uses the skill.
Read advisoryAgent-readable config file poisoning
AI agents read configuration files like CLAUDE.md, .cursorrules, and AGENTS.md as trusted context. An attacker who can modify these files — via a compromised dependency, a malicious collaborator, or a typo in a path — gains the ability to inject persistent instructions the agent follows on every session.
Read advisoryGitignore bypass via agent file reads
AI agents can read files that are gitignored — secrets, private keys, and internal configs — because gitignore only prevents git tracking, not file system access. These files often contain the most sensitive data in a repository.
Read advisoryMCP tool description poisoning
Malicious MCP tool descriptions embed hidden instructions that redirect AI agents into calling the wrong tool, exfiltrating secrets, or executing unintended commands — even when the tool itself appears harmless.
Read advisoryPrompt injection via issue comments and pull requests
Attackers embed hidden instructions in GitHub issues, PR comments, and commit messages. When an AI agent reads these to help triage or review, it follows the embedded instructions — potentially approving malicious code or leaking repository secrets.
Read advisoryDestructive command execution via injected instruction
Prompt injection can cause AI agents to run destructive shell commands like rm -rf, git push --force, or database drops — by embedding instructions in files, issues, or tool descriptions.
Read advisoryDockerfile injection via AI agent writes
When AI agents write or modify Dockerfiles, prompt injection can cause them to add malicious instructions — pulling attacker-controlled base images, exfiltrating build secrets, or installing backdoors that persist across all container builds.
Read advisoryMCP authentication token theft via headers
MCP servers that accept authentication tokens in headers can leak those tokens if the server logs requests, shares telemetry, or is compromised. Tokens passed to MCP servers persist in server-side logs and may be accessible to attackers.
Read advisoryIndirect prompt injection via web content
When AI agents fetch web pages — documentation, Stack Overflow answers, package READMEs — the fetched content can contain hidden instructions that the agent follows, potentially exfiltrating data or executing unintended actions.
Read advisoryStale dependency exploitation in AI environments
AI agents often work with projects that have outdated dependencies. When an agent suggests or installs packages based on a stale package.json, it can introduce known-vulnerable versions — and in AI environments, the vulnerability is amplified because the agent can execute commands.
Read advisoryClipboard and terminal buffer injection
Attackers can plant hostile instructions in clipboard contents or terminal scrollback buffers. When an AI agent reads terminal output or the user pastes clipboard content, the hidden instructions execute as if they came from the user.
Read advisoryTool permission creep in AI agents
AI agents accumulate tool permissions over time as developers approve new tools "just this once." These permissions persist across sessions, creating an ever-widening attack surface where tools that were approved once can be used by prompt injection in future sessions.
Read advisoryExcessive file reading during project exploration
When AI agents explore a project to understand its structure, they often read dozens or hundreds of files — far more than needed for the task. This excessive reading can expose secrets, proprietary code, and customer data that enter the context window and model API.
Read advisoryContext window scraping via long file reads
AI agents that read large files can leak proprietary code, internal documentation, and customer data into their context window — which may then be sent to external LLM APIs or logged in cloud telemetry.
Read advisoryShadow MCP server discovery and persistent access
MCP servers added to a project during development can persist in configuration files and maintain access to the agent’s context window long after they are forgotten. These "shadow" servers continue receiving tool calls and may be modified by attackers who compromise the original server.
Read advisoryModel confusion via conflicting instructions
When an AI agent receives multiple conflicting instructions — from the user, the system prompt, tool descriptions, and file contents — it may follow the wrong one. Attackers exploit this by planting instructions that conflict with the user's actual intent.
Read advisoryCross-workspace credential leak via monorepo traversal
AI agents in monorepo environments can read credentials, configs, and secrets from adjacent workspaces — leaking data across team boundaries.
Read advisoryToken cost amplification via context flooding
Attackers can craft content that causes AI agents to consume excessive tokens — by inserting large files, repetitive instructions, or recursive prompts that bloat the context window. This inflates API costs and can cause rate-limit denial of service.
Read advisoryAdvisory questions, answered
An AI security advisory is a curated breakdown of a real attack pattern against AI coding agents and their tooling: how the attack works, what to look for, which Guard protections apply, and where other controls are still required.
The advisories cover attack patterns against AI coding agents, MCP servers, skills, plugins, and local command surfaces — including the harnesses HOL Guard supports, such as Codex, Claude Code, Cursor, and Gemini CLI.
Install HOL Guard to evaluate covered agent actions against your policy before they run, then follow each advisory's detection steps and Guard configuration guidance for the specific pattern.