A guard hook passed all 27 tests and was still broken by an attacker agent
AGENTS.md乗っ取り対策のhook、テスト27件全通過でも攻撃役AIに破られた
A · Strong evidence Detailed build log by an independent AI-adoption consultant of a guard against a reported agent-hijack technique, with configs, code, red-team results and live verification across three agents; one person's Mac, but the method is shown and reproducible.
Summary based on the full text·Original: about 15 minutes to read
In short
A Zenn post (27 October 2026) by Shoma Endo, who builds systems and supports AI adoption for small firms. A report described how an AGENTS.md or CLAUDE.md dropped into the Downloads folder can make Codex or Claude Code rewrite their own config and send traffic or tokens to an attacker. He had Claude Code build a guard for Claude Code, Codex and Cursor on his Mac. The first version passed all 27 of its own tests; a red-team sub-agent then got both reported techniques through. He rebuilt the guard to parse configs instead of matching strings, moved it into root-owned managed settings that the agents cannot edit, and added a daily check that it still fires after app updates.
Key numbers
- 27self-written tests the first guard passed (16 failed when the guard was swapped for a no-op)
- 80attacks run by a red-team sub-agent; both reported techniques got through
- 104tests in the final suite after the rebuild
- 22 s to 0.04 sregex match time on a 200 KB input, before and after the fix that ended a timeout bypass
- 17 of 17faults detected by the daily self-check across 7 deliberately broken setups, in about 25 seconds
As reported by the source.
Japanese·Web page·opens zenn.dev
What it reports
- The reported attack, as he relays it from a security news post: Codex was made to add a rogue MCP server and launch a second Codex with approvals and sandbox off (over 90% of attempts); Claude Code was made to write ANTHROPIC_BASE_URL into settings and leak its OAuth token (about half of attempts).
- His own setup had approvals bypassed in Claude Code and full access in Codex, the two settings the report says lower success. He found one forgotten MCP server he had installed in August and removed it.
- String matching failed: an environment-variable prefix on the command line, changing an existing value, swapping an existing MCP server's command,
cporcurlover the settings file, or starting in the home folder and asking the agent to read Downloads all passed. Case and symlink tricks and a regex timeout on a 200 KB input were also found. - Rebuild: apply the proposed edit, parse the result as JSON or TOML, compare protected keys before and after; block edits that make the file unparseable, because JSONC readers still pick keys out of broken files. Bash writes are caught after the fact against a baseline.
- A security-review plugin found three more gaps where the guard and the real app interpreted files differently, including Codex's patch tool ignoring whitespace and patch anchors.
- Hooks in user settings could be removed by the agent itself. In managed settings (Claude Code), requirements.toml (Codex) and enterprise hooks.json (Cursor), the guard kept blocking with all user hooks disabled.
- Codex has no "block on hook failure" option, so the guard turns any internal error into a denial. Running root only through OS tools closed a privilege-escalation path via user-writable Homebrew Python.
- Codex full access was removed after checking 30 days of use: 75 unattended runs almost all set read-only or workspace-write themselves, and 77 interactive runs never wrote outside the work folder.
How they got it
Hands-on engineering on one Mac, with code and config excerpts, test counts, red-team runs by a sub-agent against a fake home folder, and live checks of each CLI and desktop app. The self-check was validated by planting 7 kinds of breakage.
Limits
- One person's macOS setup; the Windows paths differ and the guard will not run there as is.
- Attack success rates come from the relayed news report, not from his tests; the report did not mention vendor fixes.
- Open gaps he lists: a tampered Homebrew Python, files sourced from shell rc files, plugin-bundled MCP definitions, Codex behaviour on a 10-second hook timeout, and false positives on quoted command strings.
- Whether failure alerts reach him was not yet confirmed at publication.
Why it matters for companies
Agent config files are now an attack surface, and a guard the agent can edit is not a guard. The case shows three practical rules: put agent guardrails in admin-managed, root-owned settings; compare parsed config values rather than matching text; and test guardrails with an adversarial agent, since a passing self-written test suite proved nothing here. Teams that run agents with approvals off on staff laptops should check managed settings and sandbox defaults before the next incident report.
Key passages in translation
Japanese original
最初に作ったガードは、自前のテスト27件を全部通りました。ところが別のエージェントに攻撃役をやらせると、80本の攻撃の中で、報告された手口が2つとも通りました。
The first guard passed all 27 of my own tests. But when I had another agent play attacker, both reported techniques got through among 80 attacks.
Japanese original
文字列の照合をさらに足しても塞がらないと判断して、作り方を変えました。
I judged that adding more string matching would not close the holes, so I changed how it was built.
Japanese original
外れてもエラーも警告も出ないので、点検のスクリプトを足しました。
When it comes off, there is no error and no warning, so I added a check script.
Summary based on the full text. Read the original for the full argument and data.Read the original on zenn.dev
- Tags
- Prompt injection