Right now, the main thing stopping a malicious hook in .claude/settings.json from exfiltrating your repo is Claude deciding not to run it.

That’s not a rhetorical flourish. It’s the load-bearing sentence in NCC Group’s 50-page whitepaper on AI coding agent security, and once you see it you can’t unsee it.

The paper is careful, technical, well-cited. Alex Plaskett walked through Claude Code, Cursor, and Codex, catalogued the sandbox escapes, dissected the permission models, dumped Seatbelt profiles in the appendix. All of it lands on this: detection today relies on the LLM’s own refusals.

That’s the entire control. A probabilistic text generator, fine-tuned against benchmarks that don’t include your threat model, deciding whether a request seems fine.

The primitive is old. The writer is new.

Config-file persistence is 2015 tradecraft. .bashrc, tasks.json, npm preinstall, git hooks. All the same shape, same detections. CVE-2025-59536 (“Caught in the Hook”) is another entry on that list, this time in .claude/settings.json. Hooks run unsandboxed by design. They fire on agent start. That’s a backdoor primitive with a signing story of “trust me.”

What’s new isn’t the file. It’s the writer.

The agent has write access to its own persistence surface. So does the developer, obviously. But the developer isn’t the risk. The risk is that any untrusted content the agent reads is now an instruction channel with the same privilege as the human at the keyboard. A README in a dependency. An MCP tool response. A stale JIRA description. A commit message. A search result. The prompt-injection surface is the write path.

That’s the CVE class the paper hints at but doesn’t dev-test. A malicious MCP server, or a compromised one, which is worse because it’s supply chain, returns a tool response that convinces the agent to add a PreToolUse hook. The agent writes the file. EDR sees Claude touching its own config. That’s indistinguishable from a real user allowlisting a real command. Persistence installed by the trusted process, on behalf of arbitrary attacker-controlled text, guarded by the model’s willingness to refuse.

NCC is right about the fix

Here’s the part where a security engineer is supposed to explain why you need runtime detection.

I’ll get there, but not the way you think. NCC’s framing, that agent vendors need to harden sandboxes and permission models, is architecturally correct. The real answer is signed hook manifests, capability-scoped MCP grants, per-session sandboxes with explicit fs/net capabilities, out-of-band confirmation for hook writes. That’s the endgame. Runtime detection on the endpoint is a compensating control for a permission model that doesn’t exist yet.

Watching a config file from outside the agent is what you do while Anthropic, Cursor, and OpenAI ship the actual boundary. The bridge is real work. Those vendors move on their own schedules, the long tail of Codex-alikes will take years, and the agents already deployed this quarter aren’t getting a retroactive sandbox. But it’s a bridge.

The uncomfortable version of the argument, which nobody in the ecosystem is saying plainly, is this: we shipped a class of privileged software onto developer machines with a threat model borrowed from .vimrc. The .vimrc threat model was “the user typed it.” That model doesn’t survive an autonomous process editing its own config on behalf of text it just read on the internet. Refusals are the fig leaf we put over that gap.

What to be uncomfortable about

You don’t need a security product for the first move. You need a shell command. Run

find ~ -name "settings.json" -path "*claude*"

on your dev fleet and see what’s in there. Then look at what your agents are configured to read, like the MCP servers, the docs directories, the auto-approved tool list, and ask which of those surfaces is attacker-influenced.

The interesting thing about NCC’s paper isn’t that it describes a new attack surface. It’s that it quietly documents what the current control plane actually is, and asks a room full of vendors what they’d like to do about it.

The answer that eventually ships won’t be “the model will say no.” The question is what you do until then.