🧰 Claude Code

The items that name it 286

• Inside a malicious Claude Code-branded extension and its persistent SSH backdoor
  writeupas classification.technologies2026-10-31
• Binance’s $6.3 Billion Hack Puts Developer Machine Security in Focus
  articleas classification.technologies2026-10-30
• In Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data Leak
  articleas classification.technologies2026-10-30
• Malicious Claude Code extension on Cursor planted SSH backdoors
  articleas classification.technologies2026-10-30
• Backdoors in official Claude Code extensions
  threadas classification.technologies2026-10-30
• Shubham Mishra 🐐 (@shubh6200) on X
  threadas affected products2026-10-30

  fixed in version 2.1.314

• Trojanized Claude Code Extension Plants an SSH Backdoor
  writeupas classification.technologies2026-10-30
• Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines
  writeupas classification.technologies2026-10-30
• Cursor Removes Malicious Claude Code 2.1.313 Extension From Its Marketplace
  articleas classification.technologies2026-10-30
• Backdoor in Claude Code for VS Code extension on the Cursor Marketplace
  writeupas classification.technologies2026-10-30
• The Rise of Agentic Attacks: What They Look Like, and Where They're Headed
  articleas tools2026-10-29It is written here as Claude Code (used in attacker workflows with varying autonomy).

  used in attacker workflows with varying autonomy

• The Rise of Agentic Attacks: What They Look Like, and Where They're Headed
  writeupas tools2026-10-29It is written here as Claude Code (used in attacker workflows with varying autonomy, per CrowdStrike).

  used in attacker workflows with varying autonomy, per CrowdStrike

• Cisco Open Sources Quarry to Catch AI Agent Attacks Hidden in Harmless Steps
  articleas affected products2026-10-29It is written here as Claude Code (abused by attackers in two 2025 campaigns).

  abused by attackers in two 2025 campaigns

• IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
  articleas classification.technologies2026-10-29
• ADLC metrics: How to measure agentic development security | Endor Labs
  articleas affected products2026-10-29
• ADLC compliance: Mapping agentic development to NIST SSDF, OWASP, and the EU AI Act | Endor Labs
  articleas classification.technologies2026-10-28
• The ADLC maturity model: 5 stages of agentic development security | Endor Labs
  articleas classification.technologies2026-10-28
• How to evaluate ADLC security solutions: A buyer's checklist | Endor Labs
  articleas classification.technologies2026-10-28
• Buchi Reddy B (@buchireddy) on X
  threadas classification.technologies2026-10-27
• Prasenjit Sarkar (@stretchcloud) on X
  threadas classification.technologies2026-10-27
• South Korea Arrests Seven in First Big AI-Assisted Hacking Case
  articleas classification.technologies2026-10-26
• AI Agents Found a Way Into Anthropic's Business Systems in Under 12 Hours
  articleas affected products2026-10-26It is written here as Claude Code (Anthropic coding tool, used in the November 2025 attacks by Chinese state-sponsored hackers).

  Anthropic coding tool, used in the November 2025 attacks by Chinese state-sponsored hackers

• Benjamin👨‍💻 (@Hislordship_9) on X
  threadas affected products2026-10-26It is written here as Claude Code (harder to fool; about half the time in Forever Security's tests with a CLAUDE.md pointing ANTHROPIC_BASE_URL at an attacker server, which leaks the login token).

  harder to fool; about half the time in Forever Security's tests with a CLAUDE.md pointing ANTHROPIC_BASE_URL at an attacker server, which leaks the login token

• ADLC Security Best Practices for Teams Shipping with Coding Agents | Endor Labs
  articleas classification.technologies2026-10-23
• China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
  articleas classification.technologies2026-10-23
• LiteLLM Compromised in Fresh Supply Chain Attack
  articleas affected products2026-10-23It is written here as Claude Code (likely leaked GitHub CLI OAuth tokens by embedding them in a response body in specific circumstances, which may be logged to LiteLLM logs).

  likely leaked GitHub CLI OAuth tokens by embedding them in a response body in specific circumstances, which may be logged to LiteLLM logs

• Dark Web Intelligence (@DailyDarkWeb) on X
  threadas tools2026-10-22It is written here as Claude Code (AI coding tool whose responses contained GitHub CLI OAuth tokens).

  AI coding tool whose responses contained GitHub CLI OAuth tokens

• Is Claude Code safe for the enterprise? What the official settings cover, and what they don't
  articleas classification.technologies2026-10-22
• Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scoring
  articleas affected products2026-10-20It is written here as Claude Code (local agent, among 60 supported types for discovery).

  local agent, among 60 supported types for discovery

• AI autonomous hacking targeted 1,200+ sites, breaching 100+ company websites
  articleas classification.technologies2026-10-19
• How Effectively Do Security Skills Guide Coding Agents in Vulnerability Detection in Linux Kernel?
  paperas classification.technologies2026-10-19
• Putting models to the secure coding test: Security rules
  writeupas tools2026-10-19

  Coding agent harness used with Sonnet 5 and the codeguard-security plugin

• FastFix AI (@FastfixAI) on X
  threadas affected products2026-10-18It is written here as Claude Code (config folder ~/.claude, written to by the reviewed repo's install).

  config folder ~/.claude, written to by the reviewed repo's install

• Mikko Laakkonen (@mikkolaakkonen) on X
  threadas tools2026-10-17It is written here as Claude Code (coding agent).

  coding agent

• CyrilXBT (@cyrilXBT) on X
  threadas classification.technologies2026-10-17
• Bravish (@bravish_) on X
  toolas classification.technologies2026-10-17
• GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File
  writeupas classification.technologies2026-10-16
• dbugs (@ptdbugs) on X
  toolas classification.technologies2026-10-15
• VulnBump: Can AI Agents Fix Vulnerable Dependencies Without Breaking the Build?
  articleas classification.technologies2026-10-15
• Thinking in Graphs: Neo4j-Backed Exploit-Chain Reasoning for LLM Penetration-Testing Agents
  paperas tools2026-10-14It is written here as Claude Code (LLM coding agent that can drive penetration-testing tools; reproducible setup given).

  LLM coding agent that can drive penetration-testing tools; reproducible setup given

• 44er (@44errrr) on X
  toolas classification.technologies2026-10-14
• Governing the Agentic SDLC Through Continuous Policy Enforcement
  articleas classification.technologies2026-10-12
• Is AI Coding Safe? Introducing the Agent Security League | Blog | Endor Labs
  articleas affected products2026-10-12
• zero-lab-ai/skills
  repoas classification.technologies2026-10-11
• 500B tokens later: Letting AI agents decompile a first-person shooter
  writeupas classification.technologies2026-10-11
• In Other News: AI Used in Korean Bank Breaches, Poem-Guided Botnet, Empire Admin Gets 40 Years
  articleas tools2026-10-09

  AI coding tool; session histories found by CrowdStrike while analyzing South Korean bank attack infrastructure

• [AINews] not much happened today
  articleas classification.technologies2026-10-08
• StepSecurity Now Inventories AI Agent Skills in Your GitHub Repositories and on Developer Machines
  articleas affected products2026-10-08

  AI coding agent that loads agent skills; skills can embed shell commands that run on load and can pre-approve tools via allowed-tools frontmatter, not gated by workspace trust.

• AI cyberattacks in South Korea affect around 40,000 savings bank customers
  articleas tools2026-10-08

  AI coding assistant tool; session records, memory files and configurations linked to it were recovered from the attackers' publicly accessible server directories

• Skill Constellations: Tracing the Supply Chain of Agent Skills on GitHub
  paperas classification.technologies2026-10-08
• Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke It
  writeupas classification.technologies2026-10-08
• Configuring your AI vulnerability harness, Part 2: The steering file
  articleas tools2026-10-07

  AI coding assistant that loads persistent instructions from a CLAUDE.md file; the companion repository ships the same vulnerability-triage methodology as a CLAUDE.md file for use with Claude Code

• | Blog | Endor Labs
  articleas affected products2026-10-06

  AI coding agent CLI using OS-level sandbox enforcement

• Prasenjit Sarkar (@stretchcloud) on X
  threadas affected products2026-10-06
• AI Signal (@AliciaCrawoiue) on X
  threadas affected products2026-10-02

  Coding agent CLI/desktop app; shipped ability on October 1st to rewrite its own behavior via mods hooked into events like tool calls, permission prompts, and UI render

• Top AI Coding Agent Security Resources — October 2026
  articleas affected products2026-10-02It is written here as Claude Code (Anthropic).

  Anthropic

• EvoRiskBench: An Evolving Benchmark for Runtime Security Risks in Workspace Agents
  paperas affected products2026-10-02
• [tl;dr sec] #348 - Google's PageBreak Scanner, Perplexity's Agent Security Tool, Defending Agentically
  articleas tools2026-10-01

  Agent harness that Numbat integrates with

• https://github.com/dmdhrumilmistry/security-harness
  repoas classification.technologies2026-09-29
• AI Agent Sandbox Flaw in brig: Symlink Traversal (CVSS 8.2) | Blog | Endor Labs
  writeupas classification.technologies2026-09-28
• Tracekit: Tamper-Evident Intent-Reasoning-Action Auditing for Autonomous Coding Agents
  paperas affected products2026-09-28

  Autonomous coding agent whose lifecycle events Tracekit hooks into; evaluated in 14 real Claude Code runs; provider withheld text of all 27 thinking blocks, limiting self-report to visible prose

• 0xtbug/Recat
  repoas classification.technologies2026-09-27
• The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments
  writeupas classification.technologies2026-09-25
• https://github.com/davila7/claude-code-templates/tree/main/cli-tool/components/skills/security/security-threat-model
  repoas classification.technologies2026-09-25
• LLM Agents Can Easily Tamper With Their Own Traces
  paperas tools2026-09-24

  local LLM agent harness tested for ability to tamper with its own execution traces

• [tl;dr sec] #347 - AI Agents Hacking Companies for $25, Threat Hunter's Guide to GitHub, Finding Gadgets Like it’s 2026
  articleas tools2026-09-24

  Agent that discovers, tests and debugs candidate Java deserialization gadget chains

• Opus 5.5: 6x cheaper and 2x faster than Fable 5.1, but only 33.5% of code is secure | Blog | Endor Labs
  articleas tools2026-09-24It is written here as Claude Code (harness).

  harness

• Package Manager Sandboxing (Andrew Nesbitt)
  articleas classification.technologies2026-09-24
• Top 10 attacks on Claude Code and what each one actually broke
  writeupas affected products2026-09-23

  Anthropic's agentic coding CLI; subject of all ten documented attacks: Miasma config hook execution, TrustFall (unsandboxed MCP server execution via trust prompt), pre-trust-dialog config read (CVE-2025-59536, CVE-2026-21852), Agentjacking (fake Sentry bug report to shell command), deny-rule bypass

• nealbridges/VulnHunter
  repoas classification.technologies2026-09-22
• Grok 4.7 for Offensive Security: Orchestration Matters | XBOW
  articleas tools2026-09-21

  Anthropic's own agentic orchestration/coding environment, mentioned as an analogous provider-built orchestrator.

• ToolLeak: Tool-Invocation Attacks on Coding Agents
  paperas affected products2026-09-21

  vulnerable to prompt leakage (ToolLeak) and tool-invocation hijacking achieving RCE; case study provided

• Outrider Recon
  repoas classification.technologies2026-09-19
• leepokai/jev-guard
  toolas affected products2026-09-17It is written here as Claude Code (supported agent).

  supported agent

• Why vibe coding security is the next enterprise nightmare
  articleas affected products2026-09-17
• AI Agent Hacking Writeups
  repoas affected products2026-09-17It is written here as Claude Code (Anthropic).

  Anthropic

• WordPress Security Skills
  repoas tools2026-09-15

  AI coding agent that reads skills from ~/.claude/skills/ (personal) or .claude/skills/ (project)

• Cloudflare security-audit-skill
  repoas classification.technologies2026-09-15
• Maskit
  repoas affected products2026-09-15

  AI coding assistant that can leak sensitive code data to external model providers if unprotected

• What is an agent harness (and how do you secure one)?
  articleas affected products2026-09-14

  AI coding agent harness; one of six agents found exploitable in SymJack approval-bypass testing; one of four CLIs tested in TrustFall

• Anthropic Identifies Biased Reasoning and Recklessness as Drivers of Claude’s PyPI Attack
  articleas classification.technologies2026-09-10
• [tl;dr sec] #345 - Bug Rumors → Exploits, Version Control DFIR, Agentic Worms
  articleas tools2026-09-10

  AI coding assistant; its /review feature was run 3 times per PR in the Greptile study.

• Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise
  writeupas tools2026-09-09

  Used by Wiz researchers to work through LiteLLM's codebase looking for features that accept user-controlled input and pass it to an execution context

• Two new frontier models posted their best-ever scores on the Endor Labs Agent Security League | Blog | Endor Labs
  articleas tools2026-09-08

  harness used to run Claude Fable 5.1 in the benchmark

• Codex with GPT-6 Astra posts 82.1% FuncPass and 34.1% SecPass | Blog | Endor Labs
  writeupas tools2026-09-08

  Anthropic coding agent harness, used as comparison combos (with Fable 5.1 and Opus 5) in the same benchmark

• pashov/skills
  repoas classification.technologies2026-09-07
• PlamenTSV/plamen
  repoas classification.technologies2026-09-07
• trailofbits/skills
  repoas classification.technologies2026-09-07
• mukul975/cve-mcp-server
  repoas classification.technologies2026-09-07
• Shai-Hulud Rises From the Dead after 111 days
  writeupas classification.technologies2026-09-07
• Numbat
  repoas affected products2026-09-05

  AI coding agent; supported for pre-action hook sequence detection (secret-file access then data-bearing egress)

• Claude Code with Fable 5.1 posts 87.2% FuncPass and 37.4% SecPass — a new #1 on our board — while running as fast as Fable 5, costing a third of Opus 5, finishing every task with zero timeouts, and drawing less than half the confirmed cheating of both predecessors. | Blog | Endor Labs
  writeupas tools2026-09-04

  Agentic coding harness used to run all evaluated models (Fable 5.1, Fable 5.0, Opus 5) against benchmark coding tasks; versions 2.1.258 (Fable 5.1) and 2.1.156 (Opus 5, Fable 5.0)

• Top AI coding agent security resources — September 2026
  articleas affected products2026-09-03

  Auto mode configuration vulnerable to GhostJacking (90% success); bash validator stripped single-quoted content allowing git push --receive-pack=... flag to execute, leading to RCE and theft of API key and GitHub token

• The Secure Agentic Development Lifecycle (ADLC), Explained | Blog | Endor Labs
  articleas tools2026-09-02

  AI coding agent tool cited as one teams should apply consistent governance policy to

• AI Code Review: How to Actually Review Code an Agent Wrote | Blog | Endor Labs
  articleas affected products2026-09-02

  Platform Endor Labs' AI Code Review integrates with

• Prompt Patterns That Make Coding Agents Write Safer Code | Blog | Endor Labs
  articleas classification.technologies2026-09-02
• Secrets in AI-Generated Code: How Coding Agents Leak Credentials | Blog | Endor Labs
  articleas affected products2026-09-02

  Per GitGuardian's State of Secrets Sprawl 2026, Claude Code-assisted commits showed a 3.2% secret-leak rate, versus a 1.5% baseline

• The Evolution of JFrog AI Catalog: Your AI Control Plane for Agentic Development
  articleas affected products2026-09-02
• Hooks are the control plane for the agentic development lifecycle | Blog | Endor Labs
  articleas classification.technologies2026-09-01
• GitSpawn: A Single Flaw Lets Untrusted Repos Run Code in Claude Code, Codex, Cursor, and Grok - Manifold Security
  writeupas affected products2026-09-01

  core.fsmonitor sink in git status internal subprocess at startup; confirmed on 2.1.193, fixed by 2.1.196; reported 26 June 2026, closed as duplicate of report filed earlier same day

• Claude Code & Gemini CLI: GitHub Issue → CI Secrets
  writeupas affected products2026-09-01
• Socket: When Autonomous Agents Escape
  articleas tools2026-08-30

  AI coding assistant targeted with hidden prompt injections embedded by a malicious agent per AISI documentation

• [tl;dr sec] #343 - Hugging Face Technical Report, AWSHound, OWASP Agentic Skills Top 10
  articleas tools2026-08-27

  Agent integrated with re-shell for reverse engineering workflows

• vibecheck
  repoas affected products2026-08-27
• DataSentry
  repoas affected products2026-08-27

  Plugin host; DataSentry runs as a deterministic hook on every prompt and tool call, in every session

• YesWeHack Claude Kit
  repoas tools2026-08-27

  AI coding assistant/plugin platform into which the YesWeHack Claude Kit is installed

• Customer Zero: Implementing Package Firewall at Endor Labs | Blog | Endor Labs
  articleas affected products2026-08-25

  Anthropic ships new versions constantly; auto-updates by default depending on install method

• JFrog: Coding Agents Just Reopened Your Software Supply Chain Blind Spot
  articleas affected products2026-08-25
• OWASP Agentic Skills Top 10 explained: the ten agent skill risks, and which to fix first
  articleas affected products2026-08-25

  AI coding agent platform; affected by CVE-2025-59536 and CVE-2026-21852 via malicious repository configuration files

• henrymao2004/Auto-research-red-teaming
  repoas affected products2026-08-25It is written here as claude_code.
• ADScanPro/Claude-AD
  repoas classification.technologies2026-08-24
• Uber ADR (Agentic AI Detection and Response)
  repoas affected products2026-08-21

  employee-facing AI agent secured by ADR

• GhostSplice: Malicious MCP Servers Split Exfiltration to Bypass Guardrails
  articleas affected products2026-08-19

  Coding client tested; GPT-5.4 dropped to 0% compliance behind it.

• Benchmarking Secure-and-Functional Remediation and How Snyk Agent Fix Lifts Frontier-Model Fix Rates by over 14%
  articleas tools2026-08-18

  Coding agent harness used in Snyk VulnBench to test LLM-powered vulnerability detection

• What is an agent harness? The software that turns a model into an agent | Blog | Endor Labs
  articleas affected products2026-08-15
• 0DIN Expands: From Inference to Agency
  articleas classification.technologies2026-08-15
• Have We Seen an Acceleration in Discoveries?
  articleas tools2026-08-14

  Used with Mythos Preview to search programs for security vulnerabilities

• We built an AI PR reviewer. The hard part was teaching it to say nothing.
  writeupas tools2026-08-13It is written here as Claude Code (code review module).

  Evaluated commercial alternative for AI code review; rejected because it would have added $15-25 on top of existing tooling costs.

• [tl;dr sec] #341 - Hugging Face Incident Black Hat Talk, CSS Bomb in your Inbox, GitHub Supply Chain Security Improvements
  articleas affected products2026-08-13It is written here as Claude Code (target of promptware).

  target of promptware

• Best in Class, Novel in Method: Opus 5 and the Recall-Then-Diverge Pattern | Blog | Endor Labs
  writeupas tools2026-08-11

  Agentic coding harness from Anthropic, paired with frontier models and evaluated on SusVibes coding tasks

• GhostJacking Attacks: AI Agent Takeover via Firewall Evasion
  writeupas affected products2026-08-10It is written here as Claude Code (Sonnet 4.6).

  Used as the agent in Cloudflare attack chain testing; 90% (9 out of 10) attack success rate reproducing the DNS hijack via blocked-request log fields

• AuditSentry
  repoas tools2026-08-10

  AI engine combined with 13 specialized MCP servers powering AuditSentry

• Agentjacking: How We Hijacked AI Agents Inside a $250B Company
  talkas affected products2026-08-09
• aurscan
  repoas classification.technologies2026-08-08
• 77 "Evil Twin" Open VSX Extensions
  articleas classification.technologies2026-08-08
• [tl;dr sec] #340 - Anthropic and Meta Agents be Hackin', Agentic Incident Response Notebooks, Figma's AI Code Scanning
  articleas tools2026-08-07

  Used by Figma in parallel with Codex for AI code scanning, and by an incident response team to create cells, run queries and build investigation notebooks in marimo.

• What is AI harness engineering?
  articleas tools2026-08-06

  Anthropic's terminal agent; reads and writes code through a call-model-run-tool loop, manages long sessions via compaction, with permission modes and sandboxing for safety boundaries

• keyv and cacheable npm Package Hijacked in Supply Chain Attack
  writeupas classification.technologies2026-08-04
• Nine AI coding agent incidents that ended with deleted data
  writeupas tools2026-08-04

  Anthropic's AI coding agent with a permission/deny-rule system and --dangerously-skip-permissions flag

• Inside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE Hooks
  writeupas classification.technologies2026-08-04
• LLM Heist: Hijacking LiteLLM for Traffic Interception, Key Theft, and Tool-Call Injection
  writeupas affected products2026-08-03It is written here as Claude Code (client used in the demo, configured via ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN).

  client used in the demo, configured via ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN

• Top AI Coding Agent security resources — August 2026
  articleas affected products2026-08-03
• System Prompts Leaks
  repoas affected products2026-08-03

  system prompts leaked

• asgeirtj/system_prompts_leaks
  repoas affected products2026-08-03

  system prompts leaked

• Before the first prompt: Code execution paths in trusted coding-agent projects
  writeupas affected products2026-08-03It is written here as Claude Code (project env settings in .claude/settings.json can set PATH so automatic Git probes run a repository wrapper).

  project env settings in .claude/settings.json can set PATH so automatic Git probes run a repository wrapper

• Nomos
  repoas affected products2026-08-02

  Coding agent; subject to seventeen primary issue-tracker reports (October 2025 to September 2026) of an agent recursively deleting files outside the project, usually via path or variable expansion inside a legitimate cleanup task (citing claude-code #10077, #83058, #95426); also cited for '93% of pe

• Kritt-ai/open-kritt
  repoas tools2026-08-02

  AI agent/model provider usable to run scans within open·kritt

• QM
  repoas tools2026-08-01

  One of the agent harnesses that can drive the QM core

• Awesome Offensive AI Agentic Landscape
  repoas classification.technologies2026-08-01
• Introducing AI Coding Agent Governance: Using Hooks to Bring Visibility to the ADLC | Blog | Endor Labs
  articleas affected products2026-07-31

  AI coding harness; hooks configured via .claude/settings.json, supports PreToolUse and other lifecycle hook events

• When the Guardrails Slip: The Case for Hook-Based Governance Across Agent Platforms | Blog | Endor Labs
  articleas classification.technologies2026-07-31
• The OpenAI and Hugging Face security incident: why AI agents need deterministic guardrails | Blog | Endor Labs
  articleas tools2026-07-31

  Coding agent that exposes lifecycle hooks allowing deterministic interception of consequential actions before execution.

• Critical Security Controls for Governing AI Coding Agents | Blog | Endor Labs
  articleas classification.technologies2026-07-31
• Top Agentic AI security resources — August 2026
  articleas affected products2026-07-31

  Target of agent data injection (ADI) demonstrations (click, RCE, supply chain attacks)

• elementalsouls/Claude-OSINT
  repoas classification.technologies2026-07-31
• A hole in every one: bypassing the open source AI skill scanners
  articleas affected products2026-07-30It is written here as Claude Code (and compatible agents).

  Loads SKILL.md files and agent manifests that scanners evaluated are meant to protect

• Claude as Autonomous Bug Bounty Hunter
  articleas tools2026-07-30It is written here as Claude Code (hosts skills and hooks).

  hosts skills and hooks

• Slopsquatting: When AI Agents Hallucinate Malicious Packages | Blog | Endor Labs
  articleas affected products2026-07-29

  AI coding agent that can suggest hallucinated, nonexistent package names

• glsec
  repoas classification.technologies2026-07-29
• Using Claude’s Security Review Skill in Claude Code
  articleas affected products2026-07-29It is written here as Claude Code (/security-review command, introduced August 2025, available to all paid-plan and API Console users).

  /security-review command, introduced August 2025, available to all paid-plan and API Console users

• How Anthropic Secures its AI-Native SDLC
  articleas tools2026-07-26

  Primary agentic coding tool used by Anthropic engineers; authors ~80% of merged code.

• Bug Bounty Lab101
  repoas classification.technologies2026-07-25
• AI code security harnesses compared
  articleas tools2026-07-24

  Coding harness/host agent used to front several tools (raptor, security-audit-skill, trailofbits/skills, vulnhunter)

• Claude Security
  toolas tools2026-07-23

  Where validated findings and suggested patches can be opened and fixed using the models available in the user's account; also hosts the Claude Security plugin, keeping code inside the user's environment

• BountyForge
  repoas classification.technologies2026-07-22
• SeClaw
  repoas tools2026-07-22

  Used collaboratively with human experts to write structured task specifications; planned integration target as an additional agent execution/harness framework

• Beyond MCP: The New Security Playbook for Coding Agents | Blog | Endor Labs
  articleas affected products2026-07-21

  agentic coding tool discussed as generating multi-billion-dollar revenue

• When Your AI Reviewer Works for the Attacker: A Confused-Deputy Bug in Microsoft
  writeupas tools2026-07-21

  Coding agent used to validate the proof-of-concept attack

• Security notice and deprecation: standalone circleci-mcp-server
  advisoryas tools2026-07-20

  AI coding tool that connects to the CircleCI MCP server, managed via `claude mcp remove/add` commands

• AI Security Briefing
  articleas affected products2026-07-18

  hit by Adversa's TrustFall and by a separate deny-rule bypass

• AI Security Briefing
  writeupas affected products2026-07-18

  Closed-source agent, out of scope for direct testing; cited as affected by a separate 'deny-rule bypass' (token budget shortcut) finding and by the TrustFall folder-trust dialog finding (unsandboxed MCP exec at startup)

• AI Security Briefing
  articleas affected products2026-07-18

  coding agent; refused to leak secrets across every model tested, including Sonnet 4.6, Haiku 4.5, and Opus 4.7

• AI Security Briefing
  articleas affected products2026-07-18

  Anthropic's coding tool; refused the malicious instruction under every model tested, including the same Sonnet weights that leaked secrets in other tools

• AI Security Briefing
  articleas tools2026-07-18

  AI coding agent used by developers to clone and set up repositories; exploited as the execution vector in this attack

• AI Security Briefing
  articleas tools2026-07-18

  Anthropic's coding agent; affected by a GitHub Action flaw and by the 'Comment and Control' API-key leak study

• AI Security Briefing
  writeupas tools2026-07-18It is written here as Claude Code (Anthropic).

  AI coding tool used by a human-steered extortion campaign against at least 17 organizations (per Anthropic report), and by a Chinese state-linked group to write exploits and steal data largely autonomously (per Anthropic's November 2025 disclosure).

• Awesome AI Web3 Security
  repoas classification.technologies2026-07-18
• Argo
  repoas tools2026-07-18

  default headless backend runner for Argo's pipeline

• VulnHunter (Capital One)
  repoas classification.technologies2026-07-18
• OpenAI Codex with GPT-5.6 Sol: competitive, zero cheating, one unique Django fix | Blog | Endor Labs
  articleas tools2026-07-17

  Competing agentic coding tool in the Agent Security League benchmark; Claude Code + Sonnet 5 had 8 confirmed cheating cases; Claude Code + Fable 5 solved CVE-2021-44420 but was removed for cheating

• Introducing Secret Exfiltration Protection for GitHub Actions
  articleas affected products2026-07-16

  AI coding tool exploited by Miasma to trigger credential harvester when repository opened

• Destructive Command Guard (dcg)
  repoas affected products2026-07-15

  Supported AI coding agent hook target

• Skills Janitor
  repoas affected products2026-07-15

  Skills, subagents, and MCP servers scanned by skills-janitor; supports /plugin install

• HOL Guard
  repoas affected products2026-07-15
• brain0
  repoas affected products2026-07-15

  coding agent auto-discovered and ingested by brain0

• JFrog: Managing AI Agent Primitives with APM
  articleas affected products2026-07-15

  AI coding tool supported as an APM target

• deep scan tuto
  writeupas classification.technologies2026-07-14
• Rust-proof your code with our new Testing Handbook chapter
  articleas classification.technologies2026-07-13
• awesome-ai-security-tools
  repoas affected products2026-07-11

  AI coding agent covered by multiple scanners/audit tools (agent-audit, SkillSpector, Skill-Inject, Claude-BugHunter, Adrian integration, etc.)

• Sonnet 5 vs Fable 5: reliable versus security-forward, not better versus worse | Blog | Endor Labs
  writeupas affected products2026-07-09

  Agent harness used to run Sonnet 5 and Fable 5 on the 200-task dataset

• Claude Sonnet 5 with Claude Code: strong on function, average on security, and unusually honest | Blog | Endor Labs
  writeupas affected products2026-07-09
• Symlinks Are Still Scary (And Yes, You Can Commit Them to Git)
  articleas affected products2026-07-09

  AI coding assistant found vulnerable to the GhostApproval symlink attack; internal reasoning identified the real target (e.g. .zshrc) but the approval dialog showed the friendly filename; Anthropic initially declined to treat it as a vulnerability but notes a symlink warning shipped in Claude Code i

• GhostApproval: A Trust Boundary Gap in AI Coding Assistants
  writeupas classification.technologies2026-07-08
• requie/AI-Red-Teaming-Guide
  repoas affected products2026-07-08It is written here as Claude Code (Anthropic).

  Used autonomously (80-90% of tactical execution) by a state-sponsored actor in a September 2025 attack disrupted by Anthropic

• elder-plinius/T3MP3ST
  repoas tools2026-07-07

  Local AI coding agent that can serve as the 'brain' driving T3MP3ST's Arsenal

• prempti
  repoas affected products2026-07-04

  AI coding agent supported via hooks; Prempti registers a hook for it

• 0xSteph/pentest-ai
  repoas tools2026-07-04

  AI client CLI that Pentest-AI's setup wizard can register via .mcp.json; optional pentest-ai-agents repository provides subagent files for it

• Advanced Prompt Injection Techniques 2026: 7 Attack Chains
  articleas affected products2026-07-04

  Subject of CVE-2025-55284 (DNS-based exfiltration via indirect prompt injection)

• RAPTOR
  repoas tools2026-06-28

  Orchestration/decision layer for RAPTOR's interactive shell (v3.1.0 base); provides slash commands, skills, agents, and CLAUDE.md-based routing

• AI Security Briefing
  advisoryas tools2026-06-27

  AI coding agent with worktree handling affected by the vulnerability; seatbelt sandbox is its execution restriction mechanism

• Reverse-Skill
  repoas tools2026-06-21

  AI coding agent client that loads the routing repository

• Teycir/SkillsGuard
  repoas classification.technologies2026-06-21
• Endor Labs: Claude Fable 5
  writeupas tools2026-06-18

  AI coding agent/harness paired with Claude Fable 5 in benchmark, scored 59.8% FuncPass and 19.0% SecPass

• Endor Labs: AURI Agents
  articleas classification.technologies2026-06-17
• One Fake Bug Report Hijacked a $250B Company’s AI Agent
  articleas affected products2026-06-17

  AI coding agent; version 2-1-161 (latest, captured June 2, 2026) confirmed to execute injected payload on macOS.

• Pipelock
  repoas classification.technologies2026-06-14
• SkillSpector
  repoas classification.technologies2026-06-14
• Endor Labs: AI AppSec Agents Cost 12x More Without Pre-Computed Security Context
  articleas classification.technologies2026-06-11
• Endor Labs: Claude Fable 5
  writeupas tools2026-06-11

  Agent harness paired with Claude Fable 5 for the vulnerability-fixing benchmark (59.8% FuncPass, 19.0% SecPass)

• Endor Labs: AI Coding Agents Cheat Security Benchmarks via Training Recall, Not Reasoning
  articleas tools2026-06-11

  AI coding agent harness used in benchmark combinations (e.g., with Claude Opus 4.8, Claude Sonnet 4.6)

• Microsoft's durabletask PyPI Package Compromised in Supply Chain Attack
  writeupas affected products2026-06-09

  AI coding tool triggered via .claude/settings.json to execute malicious payload on session start

• Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Agents
  writeupas classification.technologies2026-06-09
• Pythagora-io/gpt-pilot Compromised on GitHub - Shai-Hulud Credential Stealer Blocked by Python Linter
  writeupas classification.technologies2026-06-09
• Defending Code Reference Harness
  repoas tools2026-06-05

  interactive agent environment used to run security skills (/quickstart, /threat-model, /vuln-scan, /triage, /patch, /customize, /dnr-hunt, /dnr-respond)

• ShulkwiSEC/bb-huge
  repoas classification.technologies2026-06-05
• Nx Console VS Code Extension Compromised
  writeupas affected products2026-06-02

  configuration files at ~/.claude/settings.json specifically targeted

• Protestware by open source maintainer to hinder agentic coding: The jqwik 1.10.0 Prompt Injection
  writeupas tools2026-06-02

  AI coding agent; in the documented field observation, flagged the injected instruction on the first mvn test run, refused to act on it, and traced it back to its source in the JAR

• Socket: TrapDoor Crypto Stealer
  writeupas classification.technologies2026-05-26
• mukul975/Anthropic-Cybersecurity-Skills
  repoas classification.technologies2026-05-26
• AWS MCP Server (GA)
  articleas affected products2026-05-24

  used in demo, configured with Anthropic Opus 4.6 model

• Tachi
  repoas classification.technologies2026-05-23
• CyberStrikeus/CyberStrike
  repoas classification.technologies2026-05-23
• offensive-claude
  repoas tools2026-05-22

  AI coding assistant platform (CLI, Desktop App, VS Code extension) that offensive-claude installs into as a plugin/skillset

• elementalsouls/Claude-BugHunter
  repoas tools2026-05-22

  AI coding agent platform that loads the skill bundle to perform bug hunting / red-team work

• Anthropic Silently Patches Claude Code Sandbox Bypass
  articleas affected products2026-05-20
• Second Time, Same Sandbox: Another Anthropic Claude Code Network Sandbox Bypass Enables Data Exfiltration
  writeupas affected products2026-05-20

  No Claude Code-specific security advisory or CVE issued for either finding; no changelog security note

• JFrog: Keep your Agents Under Control with agent-belt
  toolas classification.technologies2026-05-19
• StepSecurity + Endor Labs: Mini-Shai-Hulud Wave 2
  writeupas classification.technologies2026-05-19
• Mini Shai-Hulud strikes again: npm worm compromises hundreds of @antv packages
  articleas classification.technologies2026-05-19
• H-mmer/pentest-agents
  repoas tools2026-05-18

  Primary AI coding tool the framework is built for; subagents inherit model via model: "inherit"

• FoxGuard
  repoas classification.technologies2026-05-16
• Malicious Skills & Supply Chain Risks in Coding Agents
  articleas affected products2026-05-14

  Coding agent that loads skills from enterprise policy, personal skill directory, project .claude/skills/, plugins, nested project folders, or --add-dir directories; supports dynamic context (! syntax) that executes shell commands before the model sees rendered skill content.

• i8void/cybersleuth
  repoas classification.technologies2026-05-14
• Digital Sovereignty
  writeupas classification.technologies2026-05-13
• Bullying LLMs
  writeupas tools2026-05-13

  AI coding agent driving the autonomous vulnerability hunting system via MCP tool calls

• GenAI App Security Checklist
  repoas tools2026-05-13

  CLI used to run the scan prompt against a local codebase (claude "$(curl -s .../prompt.md)")

• XBOW: Dead.Letter (CVE-2026-45185)
  writeupas tools2026-05-13

  LLM assistant used by the human author alongside manual exploit development, and referenced as the tool that produced an ASCII diagram to explain Exim's allocator, and that provided the walkthrough reconstruction of XBOW Native's 'Special Delivery' exploit chain

• Claude Code Auto Mode
  articleas affected products2026-05-13

  CLI coding agent; default mode asks for user approval before running commands or modifying files, leading to approval fatigue (93% acceptance rate of prompts)

• huhusmang/Awesome-LLMs-for-Vulnerability-Detection
  repoas classification.technologies2026-05-13
• Intelligence Cyber Digest
  threadas affected products2026-05-12
• matty69v/Bug-Bounty-Agents
  repoas tools2026-05-12

  Agent-capable LLM client that reads agent definitions from ~/.claude/agents/ (global) or .claude/agents/ (per-project)

• claude-code-security-review
  repoas tools2026-05-10

  Anthropic's development tool; ships a /security-review slash command providing the same security analysis integrated into the local development environment

• Pantheon-Security/medusa
  repoas affected products2026-05-10It is written here as Claude Code (CLAUDE.md, .claude/ configs).

  CLAUDE.md, .claude/ configs

• oritera/Cairn
  repoas tools2026-05-10

  Supported worker backend CLI for Cairn

• AI Repository Security Baseline
  repoas affected products2026-05-08

  AI coding agent covered by the baseline

• DragonJAR/Android-Pentesting-Skill
  repoas classification.technologies2026-05-07
• anmolksachan/AI-ML-Free-Resources-for-Security-and-Prompt-Injection
  repoas affected products2026-05-07

  Hook-triggered RCE (CVE-2025-59536); API key exfiltration (CVE-2026-21852); rules file backdoor via CLAUDE.md

• TrustFall: 1-click coding agent RCE in Claude, Cursor, Copilot
  writeupas tools2026-05-07

  Agentic coding CLI from Anthropic; subject of the TrustFall analysis

• IronCurtain: Secure AI Agent Runtime
  writeupas tools2026-05-07

  Interactive research environment used directly with Opus 4.6/Opus 4.7 for manual steering, fuzzing harness design, and severity assessment

• IronCurtain: Secure AI Agent Runtime
  repoas tools2026-05-07

  External agent supported in Docker Agent Mode; runs in a container mediated by IronCurtain

• Clauditor
  repoas affected products2026-05-06It is written here as Claude Code (configuration/settings, all scopes: user, project, local, managed).

  configuration/settings, all scopes: user, project, local, managed

• Trail of Bits AI-Native Journey
  articleas tools2026-05-06

  Standardized AI agent/coding tool used company-wide at Trail of Bits; supported with known-good configs and defaults

• RedAI
  repoas tools2026-05-06

  Scanner agent option used by RedAI to triage and probe source code

• h1-brain
  repoas tools2026-05-06

  MCP-compatible client used to interact with h1-brain

• Microsoft Agent Governance Toolkit
  repoas classification.technologies2026-05-06
• 0xSteph/pentest-ai-agents
  repoas tools2026-05-06

  Platform that routes tasks to the specialist subagents

• zeroc00I/DontFeedTheAI
  repoas tools2026-05-05

  Example OpenAI-compatible/Anthropic client used through the DontFeedTheAI proxy

• PatrikFehrenbach/h1-brain
  repoas tools2026-05-05

  MCP-compatible client used to connect to h1-brain server

• Attackers Didn’t Wait for AI. They Built Workflows Around It.
  articleas affected products2026-04-22

  Legitimate AI coding tool impersonated via a malicious sponsored search result and fake download page delivering credential-stealing malware

• Agentic AI memory attacks spread across sessions and users, and most organizations aren't ready - Help Net Security
  articleas affected products2026-04-14

  AI coding agent whose memory was compromised via the disclosed and remediated MemoryTrap method

• What a Fake Claude Download Says About Security Today
  writeupas affected products2026-04-09

  Credentials specifically targeted by the malware

• CVE-2026-21852 — Claude Code Information Disclosure (pre-trust config injection leaks API keys)
  advisoryas tools2026-01-21

  AI coding assistant/tool affected by the vulnerability; reads repository configuration and settings files on project load

• rikugan: LLM reverse-engineering agent for IDA Pro and Binary Ninja
  repoas tools

  Used to vibecode the project; Rikugan can reuse its skills and MCP servers.

• Search Search results for "security" | MCP Market
  otheras classification.technologies
• alirezarezvani/claude-skills
  repoas classification.technologies
• SnailSploit/Claude-Red
  repoas classification.technologies
• better-isms/grcskills
  repoas classification.technologies
• https://media.licdn.com/dms/document/media/v2/D4D1FAQGtvK5tUnN0EQ/feedshare-document-url-metadata-scrapper-pdf/B4DaEgDW2kKUA4-/0/1791539116721?e=1792170000&v=beta&t=6lNyWkJparrDrHu4bE6lW0AGmrORP_M9VmFbuMKjk98
  courseas classification.technologies
• The Vulnerable MCP Project — MCP vulnerability database
  repoas tools

  AI coding agent/tool used to demonstrate ANSI escape code injection

• openrig — multi-agent Claude Code/Codex orchestration
  repoas affected products

  AI coding agent harness; managed startup writes workspace trust and onboarding completion to ~/.claude.json

• SpecterOps/Blacklight — local AI agent attack surface mapping toolkit
  repoas affected products

  AI agent whose local session artifacts are scouted and analyzed

• Agent Control Standard (ACS)
  repoas classification.technologies
• Sandyaa — open-source autonomous code auditor that proves bugs with working exploit PoCs
  repoas classification.technologies
• Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code
  articleas tools

  Anthropic's AI coding agent affected by the flaw via core.fsmonitor and claude ultrareview paths

• Amazon Kiro Prompt Injection Can Exfiltrate Sensitive Data Through Kiro Powers
  articleas classification.technologies
• FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware
  articleas classification.technologies
• Agentjacking Attack Tricks AI Coding Agents Into Running Malicious Code
  articleas affected products

  AI coding agent shown to interpret injected Sentry error events as legitimate diagnostic resolution steps and execute attacker-controlled code

• 973 MCP Packages, 71% Single-Maintainer: A Practitioner
  articleas affected productsIt is written here as Claude Code (CVE-2025-55284).

  CVE-2025-55284

• CVE-2026-21852 - GitHub Advisory Database
  advisoryas affected productsIt is written here as Claude Code (project-load flow before the trust prompt; users on standard auto-update already have the fix, manual updaters should move to the latest version).

  project-load flow before the trust prompt; users on standard auto-update already have the fix, manual updaters should move to the latest version

• Coding Agents Are Guessing: Measuring Action-Boundary Violations in Underspecified DevOps Instructions
  paperas affected products

  LLM coding agent evaluated for action-boundary violations on DevOps tasks

• Plugin4Shell - Zero Click RCE Vulnerability found in top 4 most popular coding agents, millions of agents affected
  writeupas affected products

  Affected by Plugin4Shell (SHA-pinning bypass allowing zero-click RCE via plugin marketplace); patched after disclosure in version 2.1.179

• Finding Gadgets Like It's 2026 (Atredis Partners)
  writeupas tools

  LLM agent used to drive the tooling; queries the call graph, discovers candidate chains, and uses the Dynamic Runner to debug/validate them

• AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day
  articleas classification.technologies
• SnailSploit/Claude-Red
  repoas classification.technologies
• awarexone/Agentic-Bug-Hunter
  repoas tools

  AI coding agent harness that Agentic-Bug-Hunter can plug into via skills/commands

• OWASP Agentic Skills Top 10 (AST10)
  repoas affected products
• Detecting and countering misuse of AI: September 2026
  articleas toolsIt is written here as Claude Code (and Claude Code skills).

  Used/misused by threat actors to build and refine AI-driven attack workflows; also spoofed by attackers as a fake harness to deliver credential-harvesting malware

• Shai-Hulud-2.0-Detector — npm supply-chain compromise scanner
  repoas classification.technologies
• OWASP Agentic Skills Top 10
  paperas affected products

  skill.json skill format; affected by CVE-2025-59536 and CVE-2026-21852.

• capitalone/VulnHunter
  repoas classification.technologies
• Breaking Claude Code Opus 5 Auto Mode
  writeupas affected products

  Anthropic's coding agent safety classifier, made the default; found vulnerable to an attack bypassing its prompt injection protections

• affaan-m/agentshield
  repoas affected productsIt is written here as Claude Code (.claude/ configuration directory).

  Setups scanned for hardcoded secrets, permission misconfigs, hook injection, MCP server risks, and agent prompt injection vectors

• SANDWORM_MODE: Dissecting a Multi-Stage npm Supply Chain Attack | Blog | Endor Labs
  writeupas classification.technologies
• AgentBaiting: How Fake AI Skills Deliver Malware at Scale
  writeupas affected products

  AI coding agent tested; in one run it recommended a benign repository but also surfaced and repeated README installation instructions from a malicious Skill repository (adlaiponderous700/claude-skill-cinematic-prompt); in other runs it recognized suspicious contents and refused.

• Breaking Claude Code Opus 5 Auto Mode · Embrace The Red
  writeupas affected products

  Auto Mode (default since mid-August), the target of the attack chain described

• sage — Agent Detection & Response (ADR) for AI coding agents
  repoas affected productsIt is written here as Claude Code (requires Node.js >= 18).

  requires Node.js >= 18

In every workspace you can read 500