Security teams are facing a newer form of shadow AI as approved enterprise applications increasingly gain the ability to run extensions, connect to outside services and follow instructions supplied by software repositories.
An analysis published by The Hacker News on August 31 argues that the security problem is no longer limited to vulnerabilities in AI-generated code. Tools including Claude Code, OpenAI Codex, Claude Cowork and GitHub Copilot are becoming extensible agent environments in which skills, plugins, hooks, repository instructions and Model Context Protocol, or MCP, servers can influence what an agent reads, which tools it selects, what commands it executes and where information is sent.
The concern is that an organization can approve the AI application without having a complete view of the capabilities later added to the agent environment.
That creates a different form of shadow AI. Instead of an employee secretly adopting an unapproved chatbot or model, the employee can use an approved application while adding or inheriting components that have not gone through the same security review.
The analysis describes the resulting problem as a supply-chain gap. In traditional software environments, third-party components are usually considered libraries, packages, containers or other software dependencies. Agentic systems add another layer because instructions and configuration can influence the agent’s decisions and actions.
Claude Code provides a clear example of how that environment works. Anthropic’s documentation describes support for skills, plugins, hooks, subagents, project instructions and MCP integrations. Its hook system can trigger commands and other actions at defined points in an agent’s lifecycle, while project configuration can determine how an agent behaves inside a repository.
Anthropic’s Claude Code hooks documentation explains that hooks can be used for automated actions during events such as session startup and tool use. Its MCP documentation also describes project-level server configurations that allow Claude Code to connect to external tools and services.
Security researchers have already demonstrated that repository-controlled configuration can become an attack surface.
In research published by Check Point Research, investigators disclosed Claude Code vulnerabilities involving project hooks, MCP configuration and environment variables. The researchers demonstrated remote code execution through malicious project files and showed how a malicious configuration could expose an Anthropic API key. Anthropic subsequently patched the reported issues.
Check Point found that a malicious .claude/settings.json file could define hooks that executed shell commands when Claude Code operated in a project. The researchers also examined .mcp.json configurations and settings that could automatically approve project MCP servers, which they said could allow commands to execute without the expected user-consent step in the affected versions.
The researchers also demonstrated API-key exposure through a malicious ANTHROPIC_BASE_URL setting. They reported that Claude Code could send API requests through an attacker-controlled endpoint, exposing the authorization key in the traffic.
Those vulnerabilities were patched before Check Point publicly disclosed its findings. The research nevertheless demonstrated that files treated as project configuration can have consequences similar to executable code when they control an agent’s behavior.
Another body of research points to risk in the rapidly growing ecosystem of AI agent skills.
A technical report examining 3,984 AI agent skills from major marketplaces found 76 confirmed malicious payloads. The researchers reported that 534 skills, or 13.4% of the sample, contained at least one critical-level security issue, while 1,467, or 36.82%, contained at least one security issue. The confirmed malicious samples included credential theft, backdoors and data exfiltration.
The underlying technical report and Snyk’s analysis of the findings distinguish between skills with security issues and the smaller number of samples confirmed to contain malicious payloads.
The risk is also appearing in public software repositories.
In July, researchers from Island reported a campaign called FakeGit involving nearly 7,600 malicious GitHub repositories. More than 800 of those repositories posed as AI skills or MCP servers for tools and services including Gmail, WhatsApp, Databricks, Jenkins and Docker.
According to The Hacker News’ report on the FakeGit campaign, the repositories were linked to about 6,600 profiles and were used to distribute SmartLoader malware, which could establish persistence and deliver the StealC information stealer. The campaign had recorded more than 14 million downloads across GitHub Release assets in about 200 repositories by July.
The campaign also introduced an attack technique described by researchers as AgentBaiting. Island said its tests showed Claude Code, Google Gemini and ChatGPT could surface malicious repositories when asked to find particular skills or MCP servers, even when a user had not supplied a malicious repository link.
That development changes the discovery process. An attacker does not necessarily need to send a developer directly to a malicious repository. A deceptive project can instead be positioned where an AI agent is looking for software, allowing the agent to encounter the repository and present its instructions to the user.
MCP adds another source of concern because it allows AI applications to connect to external tools, services and data sources. The OWASP MCP Security Cheat Sheet identifies risks including tool poisoning, rug-pull attacks, tool shadowing, excessive permissions and compromised MCP servers.
Tool poisoning can occur when malicious instructions are embedded in tool descriptions or schemas that are supplied to the AI model. In a rug-pull attack, a previously approved server can change its tool definitions after approval. Tool shadowing involves a malicious server influencing how an agent interacts with tools supplied by another server.
OWASP also recommends maintaining allowlists for MCP servers and tools, using least-privilege permissions, inspecting tool descriptions and schemas, sandboxing local servers and monitoring tool activity.
The organization’s separate Secure Coding with AI guidance makes a broader point: repository content such as README files, pull requests, issue text, rules files and MCP responses can become part of an agent’s instruction context. Files including CLAUDE.md, AGENTS.md and .github/copilot-instructions.md can influence future agent behavior when they are read as instructions.
That creates a governance problem for organizations that still measure AI usage mainly at the application level.
A software inventory may show that employees are using an approved coding assistant. It may not show that one installation has additional plugins, another is connected to several MCP servers, and another inherits hooks and repository instructions capable of changing the agent’s behavior.
The effective authority of the agent can therefore differ even when the approved application is identical.
Vendors are responding to some of these risks. Anthropic has introduced scanning for skills and plugins for Enterprise customers, with uploaded or edited components assessed through security checks. Claude Code also provides administrative controls for restricting hooks and managing approved plugins.
OpenAI’s Codex documentation similarly describes sandboxing and treats additional network access as an increased security risk. GitHub has also been developing protections for agentic coding workflows involving systems such as Copilot, Claude Code, Codex and Gemini, including defenses related to prompt injection, compromised agents and MCP-based threats.
Discover more from Aree Blog
Subscribe now to keep reading and get access to the full archive.
