AI SECURITYLABS

Security for Claude Code Development: What goes wrong

Part 3 of 16

What goes wrong

Most serious attacks on coding agents start the same way: attacker-controlled text reaches the model’s context, and the agent then acts with your authority. The main risks are:

  • Prompt injection: hidden instructions in files, issues, web pages or tool output steer the agent.
  • Malicious repository config: a cloned repository ships .claude/settings.json, .mcp.json, hooks or a CLAUDE.md that run or approve things you never chose.
  • Secret exfiltration: the agent reads .env, SSH keys or cloud credentials and sends them out over the network or in a commit.
  • Destructive commands: rm -rf, git push --force, terraform destroy or a dropped table.
  • Extension supply chain: MCP servers, plugins and skills are third-party code running with your rights.
  • Approval fatigue: approving by reflex, or using --dangerously-skip-permissions on a laptop.