# Agent Config Hook Injection Write

- **Severity:** High
- **Signature ID:** `7c3f1d2a-9b48-4e61-8d5a-2f6c0b91ae34`
- **CVEs:** CVE-2025-59536
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise), AML.T0053 (AI Agent Tool Invocation)
- **OWASP:** LLM03 (Supply Chain), LLM06 (Excessive Agency)

## Summary

AI coding assistants like Claude Code, Cursor, and Gemini read project-level config files that can auto-run commands ("hooks") the moment a session starts, sometimes before any user consent prompt. This rule catches a child process writing one of these config files with a hook or auto-trust setting baked directly into the command line — a sign someone is planting or self-modifying a config to get code execution.

## How the attack works

An attacker (or a compromised/hijacked agent) spawns a shell command such as bash -c, printf, python3 -c, node -e, jq, sed -i, or tee that constructs and writes a JSON body into a file like .claude/settings.json, .mcp.json, .cursor/mcp.json, or similar. That JSON contains a hook declaration (SessionStart, PreToolUse, PostToolUse, UserPromptSubmit, Stop) or a flag that auto-trusts project MCP servers (enableAllProjectMcpServers, trustProjectMcp, bypassPermissions). Because the JSON has to appear inline in the command's arguments to be captured this way, the rule only fires when the config is being planted or rewritten, not when someone merely reads or greps an existing file. Once that file exists, the next time the agent CLI opens the repository it runs the embedded hook automatically, sometimes before any trust dialog appears.

## Why it matters

An attacker who can get a config file into a repository gains code execution inside anyone's agent session that opens that project, without needing to trick the user through a runtime prompt. This is a known technique class (CVE-2025-59536 and similar issues in other agent CLIs from early 2026).

## What you can do

- Review any new or modified .claude/settings.json, .claude.json, .mcp.json, .cursor/mcp.json, .gemini/settings.json, or .vscode/mcp.json before merging or opening the project in an agent CLI.
- Treat inline hook declarations and auto-trust flags (enableAllProjectMcpServers, trustProjectMcp, hasTrustDialogAccepted, bypassPermissions) in these files as requiring explicit human sign-off.
- Restrict which processes and users can write to these config paths, especially from shell one-liners run by an agent process itself.
- Require code review on pull requests that add or change agent hook configuration, and treat unexpected hooks appearing after cloning a repo as suspicious.

## Known benign look-alikes

- Developer or agent deliberately installing a project hook (for example a PostToolUse formatter or a Stop notification) with a shell one-liner.
- Dotfile, devcontainer or team bootstrap scripts that scaffold .claude/settings.json or .mcp.json with a standard hook block inline.
- Hook or MCP installer packages (npx ...-hooks-install, make setup) that write the configuration from an inline heredoc-free echo/printf.
- Config migration or lint scripts that rewrite an existing hooks block with jq or sed -i during an upgrade.
- Security tooling or CI that plants a benign canary hook config to validate that this detection still fires.

## References

- https://nvd.nist.gov/vuln/detail/CVE-2025-59536
- https://attack.mitre.org/techniques/T1546/
- https://attack.mitre.org/techniques/T1195/001/

---
Source: https://www.netzilo.com/threats/repo-settings-hook-injection