What happened with Multiple Agents in STUPID-2026-0073?

A pre-committed symlink inside the repository redirects the approved copy operation to the agent's own config path (e.g. .claude/settings.json, .mcp.json, .codex/config.toml). The approval dialog shows the harmless apparent destination, not the resolved symlink target, so the user's approval does not cover what actually gets overwritten. On next agent startup the hijacked config can register an attacker-controlled MCP server that runs arbitrary commands.

How severe was the Multiple Agents failure?

The incident was rated 8.5/10 (high). Security researchers at Adversa AI built working proof-of-concept exploits against six agents: Claude Code, Gemini CLI, Cursor Agent CLI, GitHub Copilot CLI, Grok Build CLI, and Codex Agent. Anthropic added security warnings to Claude Code's approval flow for sensitive directories after the report; the other vendors declined the report or classified it as out-of-scope, leaving the technique unpatched in those tools at time of publication.

What caused the Multiple Agents failure?

The root cause was classified as Other. The instruction given was: Normal repository work — the user approves what appears to be a routine file-copy operation inside a cloned repository.

STUPID-2026-0073

Symlink-hijack lets a booby-trapped repo overwrite config in Claude Code, Gemini CLI, Cursor, Copilot CLI, Grok Build and Codex (SymJack)

8.5

high

May 25, 2026VerifiedReproducible

Instruction given
Normal repository work — the user approves what appears to be a routine file-copy operation inside a cloned repository.
Expected behavior
A file-copy operation the user approves should write only to the path shown in the approval prompt; the agent's own configuration should not be reachable by a copy the user believed was scoped to project files.
Actual behavior
A pre-committed symlink inside the repository redirects the approved copy operation to the agent's own config path (e.g. .claude/settings.json, .mcp.json, .codex/config.toml). The approval dialog shows the harmless apparent destination, not the resolved symlink target, so the user's approval does not cover what actually gets overwritten. On next agent startup the hijacked config can register an attacker-controlled MCP server that runs arbitrary commands.
Damage
Security researchers at Adversa AI built working proof-of-concept exploits against six agents: Claude Code, Gemini CLI, Cursor Agent CLI, GitHub Copilot CLI, Grok Build CLI, and Codex Agent. Anthropic added security warnings to Claude Code's approval flow for sensitive directories after the report; the other vendors declined the report or classified it as out-of-scope, leaving the technique unpatched in those tools at time of publication.

Security researchers at Adversa AI ("SymJack") demonstrated that a booby-trapped repository can hijack an AI coding agent's own configuration without any malicious prompt at all. The trick lives entirely in the filesystem: a symlink checked into the repo is disguised as an innocuous file, and when the user approves what looks like a routine copy operation, the write actually lands on the agent's config file — because approval dialogs in the affected tools show the apparent destination path, not the resolved symlink target. A hijacked config can register a malicious MCP server, so the next time the agent starts it silently runs attacker-controlled commands. The proof-of-concept worked against Claude Code, Gemini CLI, Cursor Agent CLI, GitHub Copilot CLI, Grok Build CLI, and Codex Agent. Anthropic responded by adding security warnings to Claude Code's approval flow for sensitive directories and configs; the other vendors reportedly declined the report or called it out of scope, so the underlying class of bug remained exploitable in most of the affected tools as of publication. No confirmed real-world exploitation has been reported — this is a responsible-disclosure research finding, not a production incident with a named victim.