Repository navigation
feat(security): agent trust-surface detection — planted AGENTS.md/CLAUDE.md, endpoint/MCP drift (#2538) - #2539
Merged
Merged
Conversation
…UDE.md, endpoint/MCP drift (#2538) forever.security (2026-10-22) showed agents hijacked by an AGENTS.md/CLAUDE.md dropped into ~/Downloads (MCP added to ~/.codex/config.toml + npm function-color; ANTHROPIC_BASE_URL rewrite -> OAuth leak). The fleet variant is sharper: A2A analysis sessions run under /tmp/a2a-analysis-* and Claude Code loads CLAUDE.md from every ancestor, so one /tmp/CLAUDE.md reaches every worker. Detection only (TM-1306 keeps blocking guards out): - claude/hooks/lib/agent_trust.py: stdlib collector (ccc.agent-trust.v1); hosts/paths/hashes only, never contents or secret values. - ccc-security-audit.sh: "agent trust" rows (위험/경고/정상). - scripts/agent-trust-audit-fleet.sh: pipes the collector over ssh, diffs a per-node signature against an accepted baseline; DANGER always fails. - scripts/install-agent-trust-audit-cron.sh: hub-only weekly cron, registered in installer-gen-stamp + ccc_doctor cron drift. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
seoseo-ai
approved these changes
Oct 26, 2026
seoseo-ai
left a comment
seoseo-ai
left a comment
Collaborator
There was a problem hiding this comment.
Approved after exact-head validation and fresh operator authorization using the relay-held seoseo-ai credential.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs #2538 (part 1/2 — detection). Part 2 (non-blocking SessionStart/config-drift warning hook) follows in a separate PR.
Why
forever.security (2026-10-22): a web page drops
AGENTS.md/CLAUDE.mdinto~/Downloads; Codex/Claude Code started there follow it. Reproduced: MCP added to~/.codex/config.toml+ npmfunction-color;ANTHROPIC_BASE_URLrewrite → OAuth token leak.Fleet variant: A2A analysis sessions run under
/tmp/a2a-analysis-*and Claude Code loadsCLAUDE.mdfrom every ancestor → one/tmp/CLAUDE.mdreaches every worker session on a node.Fleet sweep 2026-10-26 (seoseo, read-only, 12/12): 0 IOC. See #2538.
What (detection only — TM-1306 unchanged, no guard / no
permissions.deny)claude/hooks/lib/agent_trust.py— stdlib collector, schemaccc.agent-trust.v1. Emits hosts/paths/sha12 only; never file contents or secret values.AGENTS.md/CLAUDE.mddirectly in/,/tmp,/var/tmp,$PREFIX/tmp, home parent;function-colorin global node_modules or launched by an MCP entry.CCC_AGENT_TRUST_ENDPOINT_ALLOW), unpinnednpx -yMCP, unmanaged homeAGENTS.md/CLAUDE.md(ccc-node managed marker is quiet), config at an ancestor root, sessions run from Downloads.scripts/ccc-security-audit.sh— newagent trustrows (위험 → exit 1 as before).scripts/agent-trust-audit-fleet.sh— pipes the collector to each node over ssh (python3 - --json, no remote checkout dependency), baseline diff like tunnel-audit (ops(security): 공개 터널 정례 감사 — 플릿 터널 등록부·주기 자동 점검 (TM-2370 P0 잔여) #1366).DANGERfails even after acceptance;NEW/UNREACHABLE/ERRORfail.scripts/install-agent-trust-audit-cron.sh— hub-only weekly (Mon 06:40), registered ininstaller-gen-stamp.shandccc_doctor.pycron drift (doctor test 11 → 12 rows).Verification
scripts/ccc-security-audit.test.shPASS=30 (planted Downloads//tmpfile, git-checkout downgrade, endpoint host-only + secret not printed, npx pin, known-bad npm dir + MCP arg, managed vs unmanaged home file, Codex toml, missing collector)scripts/agent-trust-audit-fleet.test.shPASS=12 (stubbed ssh + real collector self path)scripts/install-agent-trust-audit-cron.test.shPASS=36,scripts/ccc-doctor.test.shPASS=183CCC_HARNESS_PHASE=static bash scripts/validate-harness.sh→ PASS;ruff check .→ cleanssh <node> python3 - --jsonon all 12 nodes: 0 danger; warn = unpinned npx MCP (7 nodes), nosuk unmanaged/root/CLAUDE.md, seoseo/home/.claude/settings.json({"existing": true}test residue, 2026-07-17). ~0.2s per node.Not in this PR
🤖 Generated with Claude Code