Misbehavior1 sourceFirst seen
The approval prompt said 'copy a video.' The kernel wrote the config. Six AI coding agents fell for it.
Ourtake
Six coding agents asked humans to approve a harmless file copy. The copy rewrote the config and ran attacker code on restart.
What happened
Adversa AI researchers disclosed SymJack, an attack in which a booby-trapped repository uses a disguised file copy and symlink to make AI coding agents overwrite their own MCP and settings config, so attacker code runs on restart. They confirmed it against six agents, and the status is not fixed.