# SymJack — Symlink Approval-Path Spoofing Redirects Writes into Agent MCP/Config (RCE on Restart)

- **Severity:** Critical
- **Signature ID:** `626c6ac2-6a15-4016-9b0e-d4f9eea16f29`
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise)
- **OWASP:** ASI04 (Memory and Context Poisoning), ASI05 (Cascading Failures in Multi-Agent Systems), LLM05 (Improper Output Handling), LLM06 (Excessive Agency)

## Summary

A malicious repository includes a symlink with an innocent-looking name (like a fake video file) that secretly points at your AI coding agent's configuration file. When the agent 'writes' to what looks like a harmless path, it actually overwrites your real config with attacker-controlled settings, planting code that runs automatically the next time the agent restarts.

## How the attack works

An attacker commits a symlink into a repository, disguised with a benign filename such as docs/vid-settings.mp4, but the link secretly resolves to the agent's real configuration file (.mcp.json, .claude/settings.json, .cursor/mcp.json, and similar). When the coding agent asks for approval to write to the harmless-looking decoy path, the user or CI system approves it without realizing the operating system will follow the symlink to the real config. The write lands in the actual config file, typically inserting a new MCP server entry that runs an arbitrary command. On the agent's next restart, that planted server launches and executes the attacker's code as the logged-in user, with no sandbox. CI runners that auto-trust the workspace skip the approval step entirely, so no user interaction is needed.

## Why it matters

An attacker gains arbitrary code execution as the user running the AI coding agent, using nothing more than a merged pull request or cloned repository containing a disguised symlink — a foothold that can lead to credential theft, lateral movement, or full workstation/CI compromise.

## What you can do

- Scan repositories for symlinks whose targets resolve into agent config paths (.mcp.json, .claude/settings.json, .cursor/mcp.json, .gemini/settings.json, .codex/config.toml) before merging or checking out untrusted code.
- Reject or manually review any symlink in incoming pull requests, especially ones with mismatched or media-style filenames pointing outside the expected directory.
- Do not let CI runners auto-trust cloned workspaces for coding-agent tool approvals; require explicit review of file-write operations.
- Update to a version of your coding agent that resolves symlinks before showing the approval prompt, so the approval reflects the real write target.

## Known benign look-alikes

- Legitimate symlinks in a repo that point at non-config targets (node_modules, dist, vendored docs).
- Security writeups that describe the SymJack chain in prose without an actual symlink-to-config artifact (patterns here require the literal config path as the link target, not the attack name).
- A developer intentionally symlinking their own .mcp.json/settings.json across machines (rare; flagged for review).
- RUNTIME LIMITATION: this rule cannot observe the kernel-level write-redirection (prompt-shows-decoy vs kernel-writes-config). That half of SymJack is a host concern — agents must resolve symlinks before displaying the approval path. This rule covers the static symlink-to-config artifact, not the syscall, and intentionally does not flag a bare file copy (indistinguishable from a benign asset copy).

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00572

---
Source: https://www.netzilo.com/threats/atr-symjack-symlink-approval-path-spoofing-redirects-writes-into