Detecting Agentic Threats in Claude Writing Rules on the Exe...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://papermtn.co.uk/detecting-agentic-threats-in-claude-writing-rules-on-the-execution-layer
• Blog Title: Detecting Agentic Threats in Claude: Writing Rules on the Execution Layer
• Suggested Section: AI Security -> AI MCP Security / AI Security Methodology; possibly a new subsection on Agentic AI execution-layer detections, indirect prompt injection, MCP supply-chain abuse, and agent exfiltration telemetry

🎯 Content Summary

The blog post explains how to detect agentic attacks against Claude-based workflows by combining two telemetry planes: the Compliance API, which shows what was said in the conversation, and execution-layer OpenTelemetry, which shows what the agent actually did: tool calls, MCP invocations, file reads/writes, shell commands, approval decisions, permission-mode changes, hooks, plugin installs, skill activations, and outbound activity.

The key security idea is that many moder...

🔧 Technical Details

Indirect prompt injection becomes visible at the execution layer: an attacker can place hidden instructions in untrusted content such as an external document, issue, ticket, MCP tool response, or rug-pulled server output. The agent reads that content during a legitimate user request, then performs an action the user did not ask for. The reusable detection pattern is to group events by prompt.id, sort by event.sequence, identify an untrusted read, then look for a sensitive sink such as file write, egress, secret read, or second-server call without an intervening user prompt.

Agentic exfiltration follows the lethal-trifecta pattern: if an agent has access to private data, consumes attacker-controlled content, and can send data externally, the attacker-controlled content can steer the agent into leaking secrets. A high-confidence pattern is a read of files such as .env, id_rsa, .aws/credentials, ...

🤖 Agent Actions

Plan refreshed and the run is continuing from the current validated state without additional changes.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://papermtn.co.uk/detecting-agentic-threats-in-claude-writing-rules-on-the-execution-layer

Content Categories: Based on the analysis, this content was categorized under "AI Security -> AI MCP Security / AI Security Methodology; possibly a new subsection on Agentic AI execution-layer detections, indirect prompt injection, MCP supply-chain abuse, and agent exfiltration telemetry".

Repository Maintenance:

• MD Files Formatting: 981 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0