How the attack works
An agent spawns a subprocess, such as a generated script, a `sed -i` command, or a package's postinstall hook. That subprocess writes or creates a file the agent will later read as instructions. Because the write comes from a child process rather than the agent's own tool call, normal detection that watches the agent's actions misses it; this detection instead watches file write/create activity across the whole process tree the agent spawned. The write has already completed by the time this is observed, so it is a detection of what happened, not a block.
Why it matters
An attacker who can get a subprocess to write to an agent's instruction file can plant hidden Unicode content that silently changes how the agent behaves on future tasks, without ever triggering the agent's own file-write monitoring.
What you can do
- Treat agent instruction files (CLAUDE.md, .cursorrules, similar) as sensitive config: put them under version control and review diffs before merge.
- Restrict what subprocesses spawned by an agent are allowed to write to, especially near instruction files.
- Audit instruction files periodically for non-printing or unusual Unicode characters, not just visible content.
- Treat alerts from this detection as after-the-fact evidence; investigate what the subprocess was and why it wrote to that file rather than expecting the write to have been blocked.
Known benign look-alikes
- A developer editing CLAUDE.md or .cursorrules in their own editor while the agent process is the monitored ancestor of that editor
- Repository checkout or branch switch rewriting instruction files
- Formatter or pre-commit hook rewriting the file in place