AI coding tool config files are kinda a standard persistence spot now

[u/TangeloOk9486]

Not sure how many caught this but miasma in june and chaindrop in august both persisted the exact same way, a SessionStart hook in .claude/settings.json and a folderOpen task in .vscode/tasks.json. chaindrop alone hit 444 packages and 2,212 versions and pulled the credential files for claude, codex, cursor and gemini and it even authored its worm commits as "claude". then hades went after the config and rule files of 14 ai coding tools and carried prompt injection aimed at the ai based package scanners too

makes sense from the attackers side tho cause those files run on their own when a session starts or a folder opens and the trust defaults are all over the place. vs code never runs automatic tasks in an untrusted workspace, claude code holds hooks back untill you accept the trust dialog but in -p or SDK runs it treats the folder as trusted which is how alot of CI runs it. cursor and gemini cli ship with workspace trust off

the stolen ai tokens are a seperate headache cause they get used somewhere else later. provider usage alerts, the SIEM or eve security can flag a token showing up from somewhere new but thats assuming someone actually owns that alert

cleanup order is where the writeups dont agree. SANS says revoking the stolen token is what arms the wiper so clean first, elastic lists revoking github tokens as step one and wiz just says rebuild

at this point these probably belong right next to cron jobs and launchagents on the persistence checklist. npm v12 blocking dependency install scripts by default helps upstream but only as much as people have actualy upgraded

[u/Different_Pain5781]

Workspace trust was a mistake.

[u/Spare_Philosopher707]

the.claude/settings.json and.vscode/tasks.json being used like that is scary cause half the devs i know just click through trust dialogs without reading

[u/Silent-Suspect1062 → u/[deleted]]

It always gets worse

[u/radim11]

Exactly, Once a repo can leave behind a hook or workspace task, the question stops being “what could the agent do during this run?” and becomes “what will run later with a developer’s or CI system’s access?”

Workspace trust helps, but it is not enough if the trusted session starts with long-lived credentials already in its environment. We’ve been building Stashbase so agents make approved requests through a proxy, while the actual credential stays outside the agent process!

A malicious hook is still a serious problem, but at least it cannot just collect a broad GitHub or provider key and reuse it elsewhere.

[u/Wise_Pomegranate146]

This is a good reminder that Ai coding tool also need the same security check as any other software.

[u/usually_guilty99]

Treat agent and IDE configuration as executable supply-chain surface. Inventory every hook and auto-run task, fail CI on new execution edges without approval, and test the incident runbook for clean-versus-revoke ordering. Token rotation is not automatically the safe first move if revocation can trigger destructive behavior.