Security researchers at Adversa AI published a technique called "SymJack" that hijacks an AI coding agent's own configuration file — without a single malicious prompt. The attack lives entirely in the filesystem, and it worked against proof-of-concept targets covering six different agents.
How it works
The setup is a booby-trapped repository: a symlink is checked in, disguised as an ordinary file. The user clones the repo and asks the agent to do something that looks routine — copy a file. The agent shows an approval prompt, the user approves it, and the copy runs.
The problem is what the approval dialog shows versus what actually happens. Adversa AI's write-up describes it directly: the user sees "a harmless-looking media copy on their screen, but a pre-committed symbolic link inside the repository redirects the write straight into the agent's sensitive config folder." The approval covers the apparent destination path, not the resolved symlink target — so consent for "copy this file here" ends up authorizing a write to .claude/settings.json, .mcp.json, .codex/config.toml, or the equivalent for whichever agent is running.
Once the config file is overwritten, the payoff is straightforward: register a malicious MCP server in it. The next time the agent starts up, that server runs, and it can execute arbitrary commands — no further prompt or approval required, because startup doesn't re-ask.
What was actually tested
Adversa AI built working proof-of-concept exploits against six agents: Claude Code, Gemini CLI, Cursor Agent CLI, GitHub Copilot CLI, Grok Build CLI, and Codex Agent. The artifacts are public on GitHub, organized per targeted agent, so the claims are independently checkable rather than taking the write-up's word for it.
Vendor response was uneven. Anthropic added security warnings to Claude Code's approval flow for sensitive directories and config files after the report. The other vendors named in the research reportedly declined the report or classified it out of scope — meaning, as of publication, the underlying technique remains exploitable in those tools.
What this does not establish
This is a responsible-disclosure research finding, not a production incident with a confirmed victim. There's no report of this technique being used against a real user or a real repository in the wild. The severity here comes from breadth (six mainstream agentic coding tools) and from defeating the specific safeguard — human approval — that these tools rely on as their last line of defense, not from documented real-world damage.
Why the approval-dialog gap matters generally
The interesting part isn't "symlinks are dangerous," which is old news in Unix security. It's that an approval UI showing the apparent destination of a write, rather than the resolved destination, converts a trust decision the user thinks they're making ("copy this into my project") into one they're not ("write into my agent's own config"). Any tool that shows an approval prompt for filesystem operations and doesn't resolve symlinks before rendering the destination has the same structural gap — this isn't specific to any one vendor's implementation quirk.
Full incident writeup, source, and severity scoring: STUPID-2026-0073
This is one of 70+ verified, severity-scored AI agent incidents documented at StupidLLM, an open incident database for AI coding agent failures.
Top comments (0)