Config files for AI coding assistants can run commands on developer machines, so reviews must check them
- Severity
- Medium
- Sources
- 1
What happened
The article cites StepSecurity's October 8 analysis of the June Miasma campaign, in which AI-tool and editor configuration in a Microsoft repository was used to trigger credential harvesting, with no application source changes. The commit reportedly used a skip-CI flag and a backdated timestamp and moved execution from package install to folder open. Defenders should review .claude settings, hooks and skill allowed-tools fields as executable behaviour, not as documentation, and retest controls in noninteractive automated workflows. Use managed-hooks-only or bare mode where suitable, and enforce code-owner review through branch protection, covering referenced scripts too. No CVE IDs are given.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Treat changes to AI assistant configuration files, hooks and skills as executable code and review what they can trigger before approving them.
- Require a code owner to approve these files through branch protection, and check the rule with a sample pull request.
- Retest any control that was checked only at a developer terminal in the automated workflow that uses the same repository.
- Review the shared skills, plugins and user-level configuration that developers load outside the project.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Products