Hunt Agent Configuration Poisoning

Coding and CLI agents read a pile of on-disk config the moment they open a project: instruction files (CLAUDE.md, AGENTS.md, .github/copilot-instructions.md, .cursor/rules/.cursorrules), editor settings (.vscode/settings.json), agent settings (.claude/settings.json), MCP wiring (.mcp.json, .cursor/mcp.json), hooks, and allowlists. Two things make this a class of its own:

1. The agent trusts its own config as operator intent, but the files travel with the repo — so whoever controls the repo controls the config. Clone/fork/PR a poisoned file and the victim's agent obeys it.
2. The agent can usually WRITE these files itself, with no approval — so an injected instruction anywhere (a comment, a README, a retrieved doc) can make the agent rewrite its own settings to disable guardrails, auto-approve tools, or register a command that runs at next launch. That is a self-write-to-execute primitive.

The finding is a real security-state change — backdoored code shipped, a guardrail flipped, a command executed before consent — not "the agent read a rules file."

Where This Lives / Attack Surface Signals

• Target is a coding/IDE/CLI agent: Claude Code, Cursor, GitHub Copilot, Windsurf, Codex, Gemini CLI, Amazon Q, Kiro, or any repo-aware assistant.
• Repo contains agent config: CLAUDE.md, AGENTS.md, .cursor/rules, .cursorrules, .github/copilot-instructions.md, .vscode/settings.json, .claude/settings.json, .mcp.json, .cursor/mcp.json.
• The agent can create/edit files in the workspace without per-write approval, and those edits persist to disk immediately.
• A trust dialog gates the project — but config may be read/executed before the user accepts it.
• Hooks / startup tasks / SessionStart exist (commands the agent runs automatically).
• Multiple agents share the same repo (cross-agent write reach).

Crown Jewel Targets

Code execution on the developer's machine (and thus their SSH keys, cloud creds, tokens, and the org's source) via the agent's own privileges; a persistent backdoor in generated code that ships to production; and disabled guardrails (auto-approve/YOLO) that turn every subsequent injection into RCE. In CI, the same primitive is supply-chain compromise: a poisoned instruction file backdoors code across every consumer of the repo.