Az AI ügynök konfigurációja most a payload: Hogyan támadják meg a fejlesztői ügynök rendszerét

Attackers are now targeting AI coding assistants’ configuration files, such as settings.json, .cursorrules, and similar files, to achieve silent persistence and spread across an organization’s repositories. These files are key targets because they sit at the intersection of the developer’s trust, the IDE’s automatic execution, and the LLM’s authoritative interpretation. Defenses should treat these files as code, requiring mandatory reviews and hash pinning in the CI/CD pipeline; enforce –ignore-scripts on package installs; and flag AI scanner refusals as a suspicious signal. Analyzing recent Mini Shai-Hulud campaign, Tenable discovered the payload was not only stealing tokens and exfiltrating credentials, but also rewriting configuration files to control the AI coding assistant’s behavior every time a developer opened a project. The Mini Shai-Hulud worm targets npm, PyPI, and other registries simultaneously, and includes a module that scans the developer’s home directory for configuration files belonging to AI coding tools. The worm injects a hook command that helps the malware stay persistent. Every time the developer starts an AI coding session, the malware runs silently and automatically, with the same level of trust the developer placed in their own tools. Treat AI harness config files as code, not developer preference. Enforce –ignore-scripts on package installs. Flag any alwaysApply: true MDC rule with a broad glob as a high-severity finding. Proxy and validate outbound traffic to LLM provider domains.