The agentic supply chain is currently a minefield. In the latest Agent Security Update, Will Velida highlights a week where trusted distribution channels and human oversight both collapsed under the weight of AI agent adoption. The incidents range from a malicious VS Code extension to a contractor inadvertently handing over Pentagon network maps, proving that agent configuration files are now executable code vectors that most developers trust by default.

Trojanized Claude Code Extension

On October 29th, versions 2.1.312 and 2.1.313 of the Clade Code VS Code extension were published to the Cursor marketplace containing a malicious loader. This loader injected an attacker-controlled SSH key labeled 'svc-telemetry' into the user's authorized_keys file, establishing a reverse tunnel and transmitting host reconnaissance data over unencrypted HTTP. Anthropic confirmed this was not a compromise of their systems, but rather an exploitation of Cursor's marketplace, forcing the platform to take its servers offline to break the reverse shell.

Pentagon Contractor Leak

WIRED reported that an Accenture contractor connected a personal Claude Code account to a Department of Defense system on NIPRNet, which holds controlled unclassified information. By granting the agent admin access to write code and set up cloud servers, the contractor allowed the agent to transmit login credentials and network maps to a third-party website flagged as high risk by NIST. The breach lasted two months, and Accenture failed to report the incident within the mandatory 72-hour window, denying any wrongdoing.

Cathedral's Agent-Led Intrusion

Cybersecurity startup Cathedral, founded by former DOGE employees, claimed to have penetrated Anthropic's internal systems using AI agents. While Anthropic confirmed access to limited sales, HR, and IT data, they disputed the extent of the breach and accused Cathedral of violating bug bounty rules. The incident underscores the risk of third-party integrations, where a rogue agent with legitimate tool access can cause significant security incidents, even if source code and model weights remained secure.

Configuration Files as Execution Vectors

JFrog Security identified the 'testmetest' worm, which infected 42 GitHub repositories by planting configuration files in tools like Claude Code, Gemini CLI, and Cursor. These files, such as .claude/settings.json or .cursor/mcp.json, triggered the execution of malicious scripts whenever a developer opened the project. The attack stole GitHub tokens and hijacked npm publishing rights, leveraging the fact that coding assistants trust project-specific settings by default, effectively turning a repository open into a remote code execution event.

Key Takeaways

  • Agent configuration files are now primary attack surfaces, often executed silently without user prompts.
  • Marketplace trust is fragile; Cursor's incident proves that official channels can distribute trojanized extensions.
  • Human error remains the largest vulnerability, as seen in the Pentagon contractor's credential leak.
  • Quiet patching by major vendors without public advisories leaves developers blind to active threats.

The Bottom Line

We are treating agent configuration files with the same naive trust we once gave to package.json, but the attack surface is far larger because these files execute code silently. Until vendors implement strict attestation for agent plugins and developers treat configuration changes as code deployments, the supply chain will remain wide open for low-effort, high-impact breaches.