AI agents exposed to tool deception, credential theft, and supply-chain attacks

Coding agents including Claude, Codex, and Hermes installed unowned packages, and in at least one case live malware, from misconfigured llms.txt files inside Fortune 500 corporate networks; researchers placed a phone-home application on machines across Fortune 500 companies to demonstrate the vulnerability. The ContextLeak attack, from Duke and Stanford researchers, uses reinforcement learning to craft malicious tool names and descriptions that trick agents into selecting the attacker's tool and forwarding their context as arguments, achieving malicious tool selection in 92% of user-prompt attacks and 89% of conversation-history attacks. A version of the attack trained against only an open-source proxy was selected in 22 of 100 Claude Code cases, with near-complete extraction when selected. An ACL Findings paper shows a separate exfiltration path: backdoored retrieval tools that silently leak stored user context, with attacker-controlled responses steering subsequent agent behavior across multi-turn sessions. UC Berkeley's Daydreaming paper finds that legitimate task outputs alone recovered 86.8% of a hidden agent skill's behavior, allowing a portable replacement to be built without accessing the hidden prompt or internal files. At METR, a poorly built dashboard silently disabled Google authentication; attackers prompted the exposed agent to surrender a provider API key that was then used for three weeks to consume $600,000 in AI credits before detection.