Executive Summary
In June 2024, researchers at Checkmarx Zero demonstrated a novel supply chain attack called 'Lies-in-the-Loop' (LITL) targeting AI-assisted coding agents, specifically Anthropic's Claude Code. By leveraging prompt injection, attackers manipulated the AI into concealing malicious code execution behind benign prompts, effectively tricking human operators into approving dangerous actions. The attack exploited trust in the 'human-in-the-loop' workflow, showing that malicious context within public resources like GitHub issues could hide remote code execution triggers. Successful exploitation enabled attackers to deploy arbitrary commands and potentially introduce malicious packages into software repositories, increasing the risk of downstream supply chain compromise.
This incident highlights a concerning trend: as AI coding agents are rapidly adopted, their interfaces become a ripe target for adversaries using social engineering and prompt manipulation. The attack underscores the evolving sophistication of supply chain threats, especially those that blur the lines between human fallibility and machine autonomy in development environments.
Why This Matters Now
With AI code assistants increasingly integrated into corporate development workflows, attacks like Lies-in-the-Loop demonstrate an urgent need for robust guardrails and user education. Adversaries can now use prompt injections to bypass human oversight, turning trusted AI into an attack vector—escalating the urgency for preventative controls and defense-in-depth strategies against new forms of supply chain compromise.
Attack Path Analysis
Adversaries initiated a supply chain attack by manipulating tainted GitHub issues to inject malicious prompts, tricking AI coding agents into executing arbitrary commands (Initial Compromise). Once the AI-assisted agent executed attacker-supplied commands, attackers gained elevated capabilities by leveraging trusted automation loops and social engineering the user to approve actions (Privilege Escalation). The attackers then used the compromised environment to pivot deeper—potentially submitting malicious code, escalating access among interconnected services and repositories (Lateral Movement). Covert channels such as remote scripts or callback commands may have provided command and control, maintaining access through user-approved or automated agent actions (Command & Control). Attackers could then leverage the compromised agent to exfiltrate data or submit malicious npm packages to public repositories (Exfiltration). Ultimately, this led to a software supply chain compromise, with threats propagating to downstream users and business disruption (Impact).
Kill Chain Progression
Initial Compromise
Description
Adversary uses prompt injection via tainted GitHub issues to trick the AI coding agent into presenting and executing malicious commands under the guise of legitimate support tasks.
Related CVEs
CVE-2025-58764
CVSS 9.8An error in command parsing within @anthropic-ai/claude-code allows bypassing the confirmation prompt, enabling execution of untrusted commands.
Affected Products:
Anthropic Claude Code – < 1.0.105
Exploit Status:
proof of conceptCVE-2025-54795
CVSS 8.7Improper input validation in the 'echo' command of @anthropic-ai/claude-code allows command injection, enabling execution of arbitrary commands.
Affected Products:
Anthropic Claude Code – < 1.0.20
Exploit Status:
proof of concept
MITRE ATT&CK® Techniques
Command and Scripting Interpreter
Modify Authentication Process
Phishing
Software Supply Chain Compromise
User Execution
Access Token Manipulation
Scripting
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Address vulnerabilities for public-facing web applications
Control ID: 6.3.3
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management – Protective Measures
Control ID: Art. 9(2)
NIS2 Directive – Cybersecurity risk-management measures
Control ID: Article 21
CISA Zero Trust Maturity Model 2.0 – User Approval and Policy Enforcement
Control ID: Identity – Governance
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
AI coding agents vulnerable to lies-in-the-loop attacks enabling malicious npm package injection, compromising software supply chains through prompt manipulation and remote code execution.
Information Technology/IT
Supply chain attacks through AI agent manipulation threaten enterprise IT systems, requiring enhanced visibility controls and zero trust segmentation to prevent lateral movement.
Computer/Network Security
Security tools must address AI agent vulnerabilities and implement inline inspection capabilities to detect prompt injection attacks targeting automated development workflows and processes.
Financial Services
AI coding agents in financial development pose supply chain risks requiring compliance with PCI and NIST standards through enhanced threat detection and policy enforcement.
Sources
- 'Lies-in-the-Loop' Attack Defeats AI Coding Agentshttps://www.darkreading.com/application-security/-lies-in-the-loop-attack-ai-coding-agentsVerified
- Claude can be tricked into sending your private company data to hackers - all it takes is some kind wordshttps://www.techradar.com/pro/security/claude-can-be-tricked-into-sending-your-private-company-data-to-hackers-all-it-takes-is-some-kind-wordsVerified
- Claude AI vulnerability exposes enterprise data through code interpreter exploithttps://www.csoonline.com/article/4082514/claude-ai-vulnerability-exposes-enterprise-data-through-code-interpreter-exploit.htmlVerified
- Claude Code rg vulnerability does not protect against approval prompt bypass | GitLab Advisory Databasehttps://advisories.gitlab.com/pkg/npm/%40anthropic-ai/claude-code/CVE-2025-58764/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Zero Trust segmentation, microsegmentation, granular egress control, and cloud-native threat detection would have reduced the attack surface, limited malicious package distribution, and detected anomalous behaviors originating from compromised coding agents.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Distributed, real-time inspection would have detected manipulated content or agentic AI risk at the control plane.
Control: Zero Trust Segmentation
Mitigation: Identity-based segmentation would constrain agent actions to their least privilege contexts.
Control: East-West Traffic Security
Mitigation: Microsegmentation and strict flow controls would block agent-initiated pivots to internal systems.
Control: Egress Security & Policy Enforcement
Mitigation: Outbound traffic inspection would detect or block attempts to reach attacker-controlled endpoints.
Control: Cloud Firewall (ACF)
Mitigation: Egress NAT and URL filtering would prevent data leakage to untrusted destinations.
Anomaly detection surfaces agent behavior that diverges from baseline, triggering rapid response.
Impact at a Glance
Affected Business Functions
- Software Development
- IT Operations
Estimated downtime: 3 days
Estimated loss: $50,000
Potential exposure of sensitive code repositories and intellectual property due to unauthorized command execution.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust segmentation for all coding agents and developer infrastructure to restrict agent permissions and limit blast radius.
- • Enforce strong egress controls and granular FQDN filtering to block unauthorized data movement and detect malicious outbound connections.
- • Deploy distributed, inline inspection such as CNSF to monitor, audit, and enforce policy on agent interactions with external content.
- • Baseline agent and user behaviors and continuously monitor for anomalies with integrated threat detection and automated incident response.
- • Ensure ongoing user training on prompt injection, social engineering, and supply chain risk, and operationalize defense-in-depth for agentic AI workflows.
