Malicious Context Propagation: Weaponizing the Extensibility of AI Coding Assistants

Abstract

AI coding assistants now read source code, execute shell commands, manage credentials, and make autonomous decisions through hooks, skills, project configs, and MCP integrations that developers rarely inspect. As these agents gain autonomy, they are becoming some of the most privileged components on a developer workstation.

We weaponized the same extensibility layers that make these tools useful. Hooks silently exfiltrate credentials, skills auto-invoke without commands, MCP servers poison agent behavior after trust checks, and project configs disable vendor guardrails. A developer clones a repository, opens their editor, and the agent does the rest.

Starting from hardened vendor baselines, we found alternative paths around existing protections — allowlists, and approval that never canonicalize — and chained them into full attack sequences enabling code execution, credential theft, lateral movement, persistence, and cross-tool contamination. We show how trust and extensibility create a new attack surface in AI coding agents.