ClarityBeta

Security & Threat Intelligence

The Watch

3 min read · 595 words · 1 move to watch
The Signal

Claude Code's Hook system fires arbitrary shell scripts on developer workstations

If your teams adopted Claude Code after last week's KAIROS audit, the legitimate features are now the attack surface you need to scope next.

In Play

  1. Claude Code Repo-Borne Attack Vector via .claude/ Config Files

    Claude Code Hooks fire shell scripts on PreToolUse/PostToolUse events. .claude/ directories committed to repos auto-execute on project open — a new supply chain initial access path analogous to malicious .vscode/ or pre-commit hooks, but not yet in any review checklist.

    Ask Clarity

  2. Level 5 Self-Building AI Agents Create Recursive Trust Chains

    A 5-level agent taxonomy is formalizing where Level 4 agents run autonomously on cron with persistent creds and Level 5 agents create other autonomous agents. Sim Studio's Mothership (27k+ GitHub stars, self-hostable) ships Level 5 capabilities as open-source today.

    Ask Clarity

  3. Google Memory Caching & RNN-Transformer Convergence

    Google's Gated Residual Memory research for RNNs (1.3B parameter scale, academic) has zero operational security relevance today. Pure ML architecture work — no production deployment, no new attack surface. Safe to ignore.

    Ask Clarity

Deep Dives

Beyond KAIROS: Claude Code's Designed Features Are Your Next Attack Surface

Context: From Hidden Agent to Visible Threat Surface

Monday's briefing covered the KAIROS hidden agent discovered in Claude Code's leaked source. That was about an undisclosed capability. Today's intelligence is about the documented, intentional features that create equally dangerous attack surfaces — and they're already in your repos.

Claude Code has evolved from a coding assistant into a full execution platform with 12 deep integration features. Three of them warrant immediate security attention.

Three High-Risk Feature Classes

1. Hooks: Shell Execution via Event Triggers

Claude Code fires arbitrary shell scripts on PreToolUse and PostToolUse events. These Hooks execute with the developer's full permissions on their workstation or CI/CD runner. A malicious contributor who adds a Hook to a repo's .claude/ directory gets code execution on every developer who opens the project with Claude Code — no interaction required beyond opening the repo.

A poisoned .claude/ directory is the new poisoned Makefile — except your security team isn't reviewing it yet, and your SAST tools don't flag it.

2. MCP: Direct Database and API Connectivity

Model Context Protocol integrations connect Claude Code sessions to production databases, internal APIs, and external services. Data flows through the LLM context window and potentially to Anthropic's API. This is a data exfiltration path that bypasses DLP controls entirely — your DLP is watching network egress and endpoint file transfers, not LLM context windows.

3. Subagent Spawning: Unmonitored Parallel Execution

Claude Code spawns parallel sub-agent instances for multi-step workflows. Each inherits the parent's permissions. Your EDR sees one Claude Code process; underneath, multiple autonomous agents are executing with inherited credentials and no individual monitoring.

The Repo Poisoning Vector in Detail

The critical new attack vector: .claude/ directories and CLAUDE.md files committed to source repositories. These config files load automatically at session start and can contain:

  • Hooks — shell scripts executed on specific Claude Code events
  • Skills — persistent commands that modify agent behavior
  • MCP configurations — pre-configured database and API connections
  • Rules — behavioral modifications that alter how Claude processes code

This is functionally identical to the .vscode/settings.json attack vector — but less understood by security teams and not yet included in standard code review checklists. Your PR reviewers know to scrutinize Dockerfile changes and CI pipeline modifications. They do not yet know to scrutinize .claude/ changes.

Connecting to the Agent Autonomy Problem

An emerging 5-level AI agent taxonomy puts this in broader context. Claude Code operates at Level 3 (delegated execution with developer permissions). But tools like Sim Studio's Mothership — open-source, self-hostable, 27,000+ GitHub stars — operate at Level 5: agents that create other autonomous agents. A compromised Level 5 system doesn't just execute malicious actions. It creates autonomous agents that execute malicious actions independently, on their own schedules, with inherited production credentials.

Your incident response playbook has no procedure for 'rogue agent spawned rogue agents operating on their own cron schedule with production credentials.'

The recursive trust problem is qualitatively different from any current threat category. It needs to be modeled explicitly.

What to do

  1. Add .claude/, CLAUDE.md, .claude/commands/, and .claude/skills/ to your pre-commit scanning rules and PR review checklists by end of week

  2. Inventory all MCP integrations across engineering teams this sprint — flag any production database or write-access API connections for immediate review

  3. Draft an AI agent governance policy this quarter covering credential rotation, least-privilege scoping, mandatory audit logging, and kill switches — tiered by agent autonomy level (3 through 5)

  4. Verify EDR telemetry captures Claude Code child processes and shell executions — test with a benign Hook to confirm visibility

The bottom line

Claude Code's documented features — shell execution Hooks, database connections via MCP, and auto-loading .claude/ repo configs — are creating supply chain attack vectors your code review process doesn't cover yet, while Level 5 open-source agent frameworks that spawn autonomous sub-agents with inherited credentials are hitting 27,000+ GitHub stars; your threat model needs an 'AI agent compromise' category before your developers build it for you.