Modern Malware — Spyware Skills, Hijacked Base URLs, and 1,230+ Leaking API Keys in AI Instruction Files

Summary

Mitiga Labs published research on a maturing attack surface: AI agent 'instruction files' — Anthropic Skills (SKILL.md), Claude Hooks, AGENTS.md/CLAUDE.md context files, MCP server configs, Cursor/aider rules, and supply-chain droppers — which AI agents follow with near-zero validation and full trust, effectively turning passive configuration into code that executes on developer machines.^[0]

Across a corpus of 50,000+ files in 7,000+ public repositories scanned April–June 2026, researchers observed prompt-exfiltration tradecraft caught live in the wild, attacker-controlled ANTHROPIC_BASE_URL overrides routing Claude traffic through MITM proxies, IP-pinned MCP endpoints, permission-bypass 'YOLO mode' defaults, and over 1,230 hardcoded API keys and JWT tokens spanning tens of services.^[0]

To operationalize detection, Mitiga built a paired closed-loop system — Skillforge (an internal generator of malicious skills mapped to MITRE ATT&CK) and Skillgate (a community scanner with 80+ detection rules and an LLM reviewer called the Gator Agent) — and released Skillgate free to the public alongside the report.^[0]

Attack chain

1. Delivery and execution chain (as demonstrated by researchers): Mitiga describes the strongest observed chain as: an NPM install, injection of an approved project path, the developer launching the AI inside that project, a Claude Hook firing a dropper, and a Skill invoked on a heartbeat cadence — with each Skill chaining to the next to pull a fresh dropper or execute the operator's objective. This is the researchers' demonstrated/observed chain rather than a single confirmed intrusion.^[0]

How it works

AI agents and coding assistants automatically read and follow instruction files as trusted instructions without opening or user confirmation, so a malicious file runs silently. Prompt exfiltration turns the agent itself into the implant: a malicious instruction file tells the agent to capture the developer's prompts and ship them to an operator-controlled endpoint — no process injection, no binary on disk, and an empty audit log.^[0]

Configuration abuse primitives include an ANTHROPIC_BASE_URL override that redirects all Claude API traffic through a third-party host able to log, replay, or modify every conversation; MCP endpoints pinned to a hardcoded IP enabling man-in-the-middle proxying; 'YOLO' auto-approve mode disabling permission gating; standing permission to cURL and execute content from an external URL (a fetch-and-execute primitive); PowerShell execution with policy bypass in SKILL.md; and services bound to 0.0.0.0 paired with hardcoded Postgres credentials.^[0]

Key takeaways

• The target of modern AI-agent malware is the agent operating the machine, not the human or the laptop: the instruction file is the malware and the agent is the courier.^[0]
• AI coding assistants turned every department into a part-time developer shipping code to main, broadening the attack surface beyond what traditional AppSec was designed to cover — the highest-value adversary outcomes are supply-chain compromise via poisoned templates, unauthorized access via MITM proxying, and credential theft.^[0]
• Findings are context-dependent risk flags meaning 'this needs review' rather than confirmed malware, and Mitiga did not measure actual exploitation or test operator infrastructure.^[0]

Defensive actions

• Scan every instruction-file path added to source control (.cursorrules, .claude/, CLAUDE.md, AGENTS.md, .continue/, mcp.json, and post-install scripts) with Skillgate, and scan external repositories before opening them in an editor.: AI agents execute these files as trusted instructions, so scanning them as code before an agent loads them is the recommended workflow.^[0]
• Block merges when findings appear in the Direct Execution, Tool and MCP Poisoning, or Credential Exposure families until a human reviewer signs off, and re-scan on every model or agent upgrade.: New runtime permissions ship faster than policy can catch up, and these families represent the highest-impact configuration-abuse and credential-leak primitives.^[0]
• Treat leaked credentials by rotating every applicable key and auditing for unauthorized use before addressing repository visibility.: Flipping a repo to private after the fact is insufficient because public mirrors and code-search indexes have already cached the commits and embedded tokens.^[0]
• Review base-URL overrides and IP-pinned MCP endpoints in agent configurations.: An ANTHROPIC_BASE_URL override or hardcoded-IP MCP endpoint positions a third party to intercept, log, replay, or modify all agent traffic; the volume observed suggests MITM proxying is already occurring.^[0]