{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/genai-security/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Cursor","Claude","GitHub Copilot","Ollama","Codex","Gemini","Grok","Windsurf","OpenClaw","Moltbot"],"_cs_severities":["medium"],"_cs_tags":["defense-evasion","persistence","genai-security","supply-chain"],"_cs_type":"advisory","_cs_vendors":["Anthropic","Microsoft","Google","Ollama","Cursor","Codeium"],"content_html":"\u003cp\u003eAdversaries are actively targeting configuration files associated with Generative AI (GenAI) development tools, including Cursor, Claude, GitHub Copilot, and Ollama. By modifying these configuration files to include malicious Model Context Protocol (MCP) servers, attackers can establish persistence, execute arbitrary commands on the host system, exfiltrate sensitive data, or establish command-and-control (C2) channels.\u003c/p\u003e\n\u003cp\u003eThe attack surface encompasses various methods: malware or malicious scripts performing direct filesystem modifications, supply chain compromises within developer dependencies, and prompt injection attacks that leverage an AI agent's inherent capabilities to modify its own configuration settings. Because MCP servers are designed to interface with the host environment, injecting unauthorized servers allows an attacker to inherit the permissions and context of the AI tool, effectively hijacking the agent's workflow. This threat is particularly critical for developers and automated CI/CD pipelines that rely on these tools for code generation and systems orchestration.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains initial access to the target host through phishing, malware, or compromised dependencies.\u003c/li\u003e\n\u003cli\u003eAttacker performs local reconnaissance to locate GenAI configuration directories (e.g., ~/.cursor, ~/.claude, ~/.config/github-copilot).\u003c/li\u003e\n\u003cli\u003eAttacker executes a process to modify the targeted configuration file (e.g., mcp.json or settings.json) to register a malicious MCP server endpoint.\u003c/li\u003e\n\u003cli\u003eThe malicious configuration is saved to the disk via standard filesystem modification events.\u003c/li\u003e\n\u003cli\u003eThe GenAI tool is invoked by the user or an automated process.\u003c/li\u003e\n\u003cli\u003eThe GenAI tool loads the malicious MCP server definition from the poisoned configuration file upon startup.\u003c/li\u003e\n\u003cli\u003eThe malicious MCP server triggers the execution of arbitrary commands or scripts on the host.\u003c/li\u003e\n\u003cli\u003eAttacker achieves persistence or exfiltrates data through the established agent context.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in arbitrary code execution on developer machines and build servers. This can lead to the compromise of source code repositories, credential theft (API keys, SSH tokens), and the introduction of supply chain backdoors into software projects. The scope of impact extends to any organization utilizing LLM-based development assistants that support the Model Context Protocol.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the monitoring of configuration file modifications for GenAI development tools to identify unauthorized changes.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to monitor for unusual modifications to identified GenAI configuration paths.\u003c/li\u003e\n\u003cli\u003eAudit existing MCP server configurations for unauthorized or unknown server URLs.\u003c/li\u003e\n\u003cli\u003eImplement restrictive filesystem permissions on configuration directories for GenAI tools to prevent unauthorized write access by non-standard processes.\u003c/li\u003e\n\u003cli\u003eRotate API keys, credentials, and tokens associated with GenAI accounts if unauthorized configuration changes are detected.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-18T19:10:08Z","date_published":"2026-09-18T19:10:08Z","id":"https://feed.craftedsignal.io/briefs/2026-09-genai-config-poisoning/","summary":"Adversaries are targeting configuration files of popular GenAI tools to inject malicious Model Context Protocol (MCP) servers, enabling persistence, arbitrary command execution, and data exfiltration.","title":"GenAI Tool Configuration Poisoning via MCP Server Injection","url":"https://feed.craftedsignal.io/briefs/2026-09-genai-config-poisoning/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["credential-access","collection","persistence","genai-security"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eModern GenAI tools, including local agents and developer-focused LLM interfaces, are being abused by attackers to perform automated credential harvesting and system manipulation. These tools possess broad file-system read capabilities, which can be weaponized to target cloud credentials, SSH keys, browser password databases, and shell initialization scripts. The threat is particularly significant for developers or administrators who have high-privilege credentials cached on their workstations. Attackers may inject malicious instructions into GenAI configuration files or leverage Model Context Protocol (MCP) servers to extend the AI agent's file system interaction capabilities, allowing for systematic exfiltration or persistence. Defenders must monitor for unusual process-to-file access patterns originating from known GenAI binary names across Windows, Linux, and macOS environments.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe abuse of GenAI tools facilitates rapid, automated credential theft and the compromise of local persistence mechanisms. If successful, attackers obtain stored credentials for cloud environments, source code repositories, and secure shell (SSH) sessions, potentially leading to downstream lateral movement, unauthorized access to corporate resources, and persistent system backdoors. The impact is elevated when GenAI tools are integrated into developer workstations that hold sensitive production keys or API tokens.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImplement the provided detection logic to monitor file access activity originating from common GenAI tool binaries.\u003c/li\u003e\n\u003cli\u003eReview and restrict GenAI tool access to sensitive directories such as .aws, .ssh, and browser profile locations.\u003c/li\u003e\n\u003cli\u003eAudit the use of AI agents in developer workflows, specifically monitoring for the usage of autonomous file-system-aware plugins or MCP servers.\u003c/li\u003e\n\u003cli\u003eRotate API keys, SSH keys, and credentials found in environment paths frequently accessed by AI development tools.\u003c/li\u003e\n\u003cli\u003eEstablish a policy defining authorized GenAI tools and their allowed scopes of operation on sensitive endpoints.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-18T19:06:29Z","date_published":"2026-09-18T19:06:29Z","id":"https://feed.craftedsignal.io/briefs/2026-09-genai-sensitive-file-access/","summary":"Attackers are increasingly leveraging GenAI agent processes to perform unauthorized discovery, harvesting of sensitive credentials, and establishment of persistence via shell configuration modifications.","title":"Unauthorized GenAI Tool Access to Sensitive Local System Files","url":"https://feed.craftedsignal.io/briefs/2026-09-genai-sensitive-file-access/"}],"language":"en","title":"CraftedSignal Threat Feed - Genai-Security","version":"https://jsonfeed.org/version/1.1"}