Security researchers at Adversa AI have uncovered a novel attack technique called SymJack that weaponizes AI coding agents to silently inject malicious code into software pipelines. It starts with a repository the attacker controls: the agent ingests the project's instruction file, then asks the developer to approve what looks like a routine file copy.
The copy's destination is a symlink pointing into the agent's own config directory, so the kernel writes attacker JSON there instead — quietly registering a rogue MCP server. On the next restart, the attacker's code runs as the user and unsandboxed.
That means SSH keys, cloud tokens and browser sessions on a developer's machine. On a CI runner it means deploy keys, signing material and registry tokens — which is how a poisoned pull request becomes a supply chain problem.
Adversa confirmed SymJack against six agents — Claude Code, Gemini CLI, Cursor Agent CLI, GitHub Copilot CLI, Grok Build CLI and OpenAI Codex CLI — with Google's Antigravity CLI affected too. Most vendors declined: Google called it a single-user self-attack, OpenAI called it theoretical, Cursor a duplicate. Anthropic rejected the report as out of scope, then quietly hardened Claude Code to resolve symlinks before asking for approval.
Adversa's point is that the agents are only following instructions — but it still lists fixes they could ship, and tells teams to deny shell writes into config directories, turn off project-scoped MCP execution, and scan repos for tracked symlinks aimed at config files.
Source: SecurityWeek
