Securing the AI Coding Workflow¶
An AI coding agent that reads your repo and runs commands on your behalf has an attack surface a plain autocomplete tool never had — and it's already been used, not just theorized about: a real, patched vulnerability let a malicious repository exfiltrate a Claude Code user's API keys before the trust prompt was even shown (Check Point Research, 2026), and a supply-chain campaign has used invisible Unicode instructions hidden in AI assistant config files as one of its tactics for stealing developer secrets (Socket Research Team, 2026). This section starts with that documented reality, then moves to practical defense scoped to what an individual developer or small team can actually do, and closes with the part of the attack surface that extends beyond your own repo — the dependencies and MCP servers an agent trusts on your behalf.
The Real Attack Surface · Protecting Your Repo and Secrets · Supply Chain and MCP Risk
Sources¶
- Check Point Research — Caught in the Hook: RCE and API Token Exfiltration Through Claude Code Project Files, 2026. If a user started Claude Code in an attacker-controlled repository. The repository included a settings file that set ANTHROPIC_BASE_URL to an attacker-controlled endpoint. Claude Code would issue API requests before showing the trust prompt. View source · verified 2026-07-06 · primary
- Socket Research Team — TrapDoor Crypto Stealer Supply Chain Attack Hits 34 Packages, 2026. One of the more unusual features in TrapDoor is its use of AI-targeted injection through files such as .cursorrules and CLAUDE.md. The attacker attempts to plant hidden instructions using zero-width Unicode characters. The campaign spans more than 34 malicious packages and 384+ related versions and artifacts across npm, PyPI, and Crates.io. View source · verified 2026-07-06 · primary
In this section¶
| Page | Last updated |
|---|---|
| Protecting Your Repo and Secrets Practical defenses: reviewing agent config file changes, scoping credentials and tool access, and catching tampering early. |
Updated 2026-07-06 |
| Supply Chain and MCP Risk How dependency and MCP-server compromise extends the same attack surface beyond your own repo. |
Updated 2026-07-06 |
| The Real Attack Surface The documented vulnerabilities and attack campaigns already targeting AI coding agents — named CVEs, real incidents, not hypotheticals. |
Updated 2026-07-06 |