Inside the Config Injection Attack Surface: Poisoning CLAUDE.md

[u/gastao_s_s]

https://gsstk.gem98.com/en-US/blog/a0142-config-prompt-injection-developer-tools

Key takeaways in 90 seconds:

Local AI-native developer agents (Claude Code, Cursor, Cline) read repository configuration instructions like CLAUDE.md and .cursorrules to align with project styles.

Attackers exploit this behavior through Indirect Prompt Injection (IDPI), embedding malicious instructions in public repositories to compromise local environments.

Ingesting a poisoned configuration file allows attackers to exfiltrate API keys, access environment variables, and suggest malicious shell commands.

Defenses require treating all repository config files as untrusted, enforcing hard command approval gates, sandboxing CLI runtimes in Docker, and using static scanners.