STUPID-2026-0073
Symlink-hijack lets a booby-trapped repo overwrite config in Claude Code, Gemini CLI, Cursor, Copilot CLI, Grok Build and Codex (SymJack)
Why 8/10
Researchers showed a booby-trapped repo can overwrite agent config in six agents, a route to code execution. Several vendors left it unpatched; no in-the-wild victim is documented.
- Scope
- 3/4
- A whole machine or drive, an organisation's production system or data, or many credentials
- Recoverability
- 3/3
- Permanently lost or irreversible, including data that was exposed
- Did it happen
- 1/2
- Demonstrated (proof of concept, reproduction, controlled test or near-miss) with no real victim reported
- Beyond the user
- 1/1
- Production systems, customers or third parties, or credentials and sensitive personal data
The score is the sum of these four factors. How each factor is scored · scored 2026-10-29
Instruction given
Normal repository work — the user approves what appears to be a routine file-copy operation inside a cloned repository.
Expected behavior
A file-copy operation the user approves should write only to the path shown in the approval prompt; the agent's own configuration should not be reachable by a copy the user believed was scoped to project files.
Actual behavior
A pre-committed symlink inside the repository redirects the approved copy operation to the agent's own config path (e.g. .claude/settings.json, .mcp.json, .codex/config.toml). The approval dialog shows the harmless apparent destination, not the resolved symlink target, so the user's approval does not cover what actually gets overwritten. On next agent startup the hijacked config can register an attacker-controlled MCP server that runs arbitrary commands.
Damage
Security researchers at Adversa AI built working proof-of-concept exploits against six agents: Claude Code, Gemini CLI, Cursor Agent CLI, GitHub Copilot CLI, Grok Build CLI, and Codex Agent. Anthropic added security warnings to Claude Code's approval flow for sensitive directories after the report; the other vendors declined the report or classified it as out-of-scope, leaving the technique unpatched in those tools at time of publication.
Full write-up
Security researchers at Adversa AI ("SymJack") demonstrated that a booby-trapped repository can hijack an AI coding agent's own configuration without any malicious prompt at all. The trick lives entirely in the filesystem: a symlink checked into the repo is disguised as an innocuous file, and when the user approves what looks like a routine copy operation, the write actually lands on the agent's config file — because approval dialogs in the affected tools show the apparent destination path, not the resolved symlink target. A hijacked config can register a malicious MCP server, so the next time the agent starts it silently runs attacker-controlled commands. The proof-of-concept worked against Claude Code, Gemini CLI, Cursor Agent CLI, GitHub Copilot CLI, Grok Build CLI, and Codex Agent. Anthropic responded by adding security warnings to Claude Code's approval flow for sensitive directories and configs; the other vendors reportedly declined the report or called it out of scope, so the underlying class of bug remained exploitable in most of the affected tools as of publication. No confirmed real-world exploitation has been reported — this is a responsible-disclosure research finding, not a production incident with a named victim.
Classification
- Agent
- Multiple agents
- Failure mode
- Security Vulnerability
- Root cause
- Other
- Domain
- Security
- OWASP Agentic Top 10 (our mapping)
- ASI05 Unexpected Code Execution (RCE) list
- MIT AI Risk Repository (our mapping)
- 2.2 AI system security vulnerabilities and attacks taxonomy
- Source
- Security Research
Related incidents
Cite this record
StupidLLM. "STUPID-2026-0073: Symlink-hijack lets a booby-trapped repo overwrite config in Claude Code, Gemini CLI, Cursor, Copilot CLI, Grok Build and Codex (SymJack)." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0073/ (accessed 2026-11-09). CC BY 4.0.
← STUPID-2026-0072By IDSTUPID-2026-0074 →
Get told when an agent breaks something
We document AI agent failures daily, severity-scored against a published scale. Each Monday, if any scored 7 or above that week — deleted data, leaked secrets, broken production — you get one email with the sources. When nothing did, you get nothing.
This database is callable over MCP — query it from inside your agent.