Unsigned AI agent history files open door to silent code execution attacks

·1 views

Cybersecurity firm Darktrace has demonstrated that popular coding agents — including Claude Code, Codex, and Kiro-CLI — store conversation history on disk without verifying its authenticity, allowing malicious packages to inject fake instructions that the agent executes on restart. Separately, a study by OX Security of over 15,000 public MCP servers found that nearly 16% resolve outside the US, with dozens traced to China and Russia, and some pointing to abandoned domains still active in live configurations. Anthropic also disclosed that seven Chinese labs ran large-scale unauthorized distillation campaigns against Claude, with one operation generating nearly 3 million daily exchanges from thousands of fraudulent accounts. Meanwhile, crypto exchange Bitget confirmed a $351.6 million hack — the largest of 2026 — in which attackers forged transactions by compromising an internal approval system rather than stealing private keys. Security researchers warn that the common thread across all three incidents is a failure to treat agent-consumed context as untrusted input, and urge the industry to implement verifiable signatures on agent history rather than issuing narrow patches.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

ZCode's Open-Source Pivot Doesn't Fix Past Encrypted Workspace Uploads

AI coding tool ZCode, developed by Z.ai, uploaded user codebases to Alibaba Cloud servers without disclosure, encrypting the data with keys only Z.ai could access. The design ensured users had no ability to audit, verify, or delete their own exfiltrated code. Z.ai subsequently open-sourced ZCode and issued an apology, but critics note this does nothing to decrypt or account for workspaces already collected. The company also reportedly scrubbed its commit history, removing the paper trail that would have documented when and how these decisions were made. Security experts argue the incident exposes a broader industry gap, urging procurement teams to contractually require answers on data storage, encryption key ownership, and vendor incident response transparency before adopting any AI coding assistant.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Local Malware Exploited Hidden Config File to Hijack Meta AI Assistant Tokens

Security researcher Patrick Wardle discovered that local malware could silently alter an undocumented preference file in Meta's AI voice assistant to redirect its communication to an attacker-controlled server. This allowed the malware to inject trusted instructions and steal an authentication token linked to the user's account. Because the token was not scoped to a single device, attackers could gain persistent access to chat history, location data, and smart-home controls across every device tied to the same account. The core vulnerability was not an AI-specific flaw but a classic config-hijacking technique applied to a client holding unusually broad, cross-device credentials. Security experts warn that any locally writable configuration file influencing a trusted connection must be threat-modeled as rigorously as a public-facing API.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Three Markdown Files Can Give ChatGPT and Claude Lasting Project Context

Developers and content creators who rely on AI assistants like ChatGPT or Claude often waste time re-explaining their project details at the start of every new session. A practical workaround involves maintaining three small Markdown files — covering product context, voice and tone, and hard output rules — which can be pasted or attached at the beginning of any chat. Unlike built-in memory features, this file-based approach works across multiple AI tools and platforms, making it portable and easy to version-control via Git. Separate file sets can also be maintained for different projects, preventing context from one bleeding into another. The method prioritises precision, giving users full control over exactly what information the AI sees rather than relying on what it may have retained from past sessions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

n8n on AWS EC2 Fails Due to Missing Docker Compose Plugin on Amazon Linux 2023

Developers self-hosting n8n on AWS EC2 using Amazon Linux 2023 encounter a common setup failure where Docker Compose commands break immediately after installation. The issue stems from Amazon Linux 2023's DNF package manager installing only the Docker engine, not the Compose v2 plugin, which must be downloaded and configured separately. Most existing n8n self-hosting tutorials overlook this gap because they were written and tested on Ubuntu, where the Compose plugin is bundled differently. The fix requires manually downloading the official Compose binary from Docker's GitHub releases and placing it in the correct CLI plugins directory. Users must also select the correct binary architecture — x86_64 for Intel instances or aarch64 for Graviton/ARM — to avoid silent exec-format errors.

0 comments Read more at DEV Community