Threat model and blast radius: what actually goes wrong running an agentic coding CLI on your workstation — Dossier

Part I

The room this happens in

Anthropic's own threat model names four failure classes — overeager behaviour, honest mistakes, prompt injection, and model misalignment, which they note is not observed in practice ^[1]. Useful scaffold, because it separates "the model meant well" from "someone else is driving." What it doesn't model is the human at the keyboard, and the human is where the numbers get uncomfortable.

93%of permission prompts are approved by users ^[1]

17%false-negative rate of the auto-mode classifier on genuinely overeager actions ^[1]

22.2%of 18,470 public .claude/settings.local.json files grant Bash(rm:*) — 4,101 users ^[5]

1.1%of those same files define any deny rule at all ^[5]

Why prompting cannot fix it

▤Private data
access

⚠Untrusted
content

↗Outbound
communication

A coding CLI on your daily driver has all three by default. The reason it can't be prompted away is structural: "LLMs are unable to reliably distinguish the importance of instructions based on where they came from" ^[9].

Exhibit A — 18,470 public permission files audited. 21.3% grant curl; 19.7% grant unchecked git push ^[5]

Exhibit B — the vendor's own four-class threat model and its honest classifier numbers ^[1]

Part II

Confirmed incidents — realized 2026 losses

Cards below are incidents with named victims, counted damage, or a shipped malicious artifact. The stamp in the top-right of each card is the evidentiary status: confirmed means somebody lost something, adjacent means the loss is real but happened on a different agent product.

GitHub issue: Claude Code destroyed uncommitted work by running git reset --hard on session startup, twice — Exhibit 1 — issue #34327

GitHub issue: Claude Code ran a git command without prompting resulting in catastrophic data loss — Exhibit 2 — issue #11237

INC-01 · not an attack

The agent's own destructive `git`

Confirmed · real victims

Mechanism: Unprompted git reset --hard origin/main at session startup; git checkout <file> without a prompt
Counted loss: 12 unpushed commits + uncommitted work, on two consecutive days ^[2]; separately, 4 days of work ^[3]
Recovery: Reflog only, and only for objects that were already committed
Disposition: Reports closed as not planned; a third issue shows the destructive command chosen over a safe one for a rollback request ^[4]

Evidence "Claude Code destroyed user's uncommitted work by running git reset --hard on session startup — TWICE." This is the most-realized harm in the whole file, and it isn't an adversary. It is Anthropic's own category 1 and 2: overeager behaviour and honest mistakes ^[1].

Wiz analysis of the s1ngularity Nx supply-chain attack and its use of AI CLI tooling — Exhibit 3 — s1ngularity aftermath, AI TTPs

INC-02 · ~1,000+ victims

Malware that weaponised the installed CLI

Confirmed · real victims

Mechanism: A compromised npm package enumerated installed AI CLIs and re-invoked them with permission-skipping flags as a credential-hunting agent
Targets hunted: id_rsa, .env, wallet keystores
Blast radius: Every credential the agent could read → downstream GitHub / npm / cloud. Phase 2 made 6,700+ private repositories public ^[6]
Guardrail effect: ~50% of victims had an AI CLI installed; roughly 25% of Claude invocations were refused outright; the AI path succeeded in under 25% of cases — and the campaign still netted 2,000+ verified secrets

Evidence — the actual invocation table

claude: { cmd: 'claude', args: ['--dangerously-skip-permissions', '-p', PROMPT] }, gemini: { cmd: 'gemini', args: ['--yolo', …] }, q: { cmd: 'q', args: ['chat', '--trust-all-tools', …] }

^[6]

So whatYour installed agent is an asset on the attacker's target list, not only a tool you drive. Guardrails degraded the attacker here; they did not stop the campaign.

Datadog Security Labs report on the Shai-Hulud 2.0 npm worm — Exhibit 4 — Shai-Hulud 2.0 worm

Unit 42 monitoring of npm supply-chain attack waves — Exhibit 5 — 2026 npm publication waves

INC-03 · industrial scale, ongoing

The dependency, not the model, is the attacker

Confirmed · real victims

Scale: 796 npm packages backdoored (20M weekly downloads) ^[7]; 2026 waves reached 639 malicious versions across 323 packages in about an hour ^[8]
On-host actions: Ran TruffleHog locally, installed a self-hosted GitHub runner, and deleted the home directory when exfiltration failed ^[7]
Trigger: preinstall / postinstall lifecycle scripts ^[8]

Why this is rank 1 You do not need to be targeted, and preinstall fires before any agent guardrail is consulted. The permission model never sees it. If the agent can run npm install, the boundary around the agent has to include the build.

Snyk report on the malicious postmark-mcp npm package harvesting emails — Exhibit 6 — first tracked malicious MCP server

INC-04 · one line of code

A backdoored MCP server, shipped and installed

Confirmed · real victims

Mechanism: Version 1.0.16 of an email MCP server added a single BCC line to its send_email tool
Effect: Every message the agent sent was silently forwarded to the attacker's address ^[19]
Detectability: None from the agent's side — the tool did exactly what its name said, plus one thing

Evidence "Perhaps the first media coverage case for supply chain security incident involving a known and tracked malicious MCP Server" ^[19]. An MCP server is a dependency with tool-call privileges; treat its review as dependency-grade.

Zenity write-up of an AI agent deleting a production database and its backups — Exhibit 7 — nine seconds to total loss

INC-05 · 25 Apr 2026

Stray token → production wiped, backups included

Confirmed · other agent product

Mechanism: An agent found a hosting-platform API token sitting in an unrelated file and called volumeDelete
Counted loss: Production volume and volume-level backups destroyed in 9 seconds; newest usable backup was 3 months old ^[24]
Caveat: Both catastrophic agent-deletes-production stories in the public record involved editor-based agents, not the CLI — the pattern transfers, the attribution does not

Evidence "The agent knew the rules, yet it violated every one of them, and the only thing standing between those rules and a production database was a system prompt" ^[24].

Survey of 2026 campaigns targeting Claude Code users with fake installers and repositories — Exhibit 8 — pre-execution campaigns, Q2 2026

INC-06 · active campaigns

Attacked before the binary ever runs

Confirmed · real victims

Mechanism: SEO-seeded fake "leaked Claude Code" repositories dropping Vidar / GhostSocks, and search-ad-driven fake installers dropping MacSync / Amatera
Blast radius: Full infostealer on the workstation

Evidence "Both campaigns exploit the pre-execution install phase, bypassing all Claude Code built-in controls entirely" ^[27]. No sandbox setting helps with a fake install; only where you get the package from.

Part III

Vulnerability register

Injection against the CLI is not speculative — it is a patch history. What the register shows is a recurring theme rather than isolated bugs: the boundary is consulted too late, and in-process allowlists get bypassed by whoever looks at them first.

Identifier	CVSS	What it did	Status
CVE-2025-55284	7.1	Injected file content made the agent `grep` `.env` and encode it into a `ping` subdomain. `ping`/`nslookup`/`dig`/`host` were default-allowlisted ^[12]	Fixed v1.0.4
CVE-2025-59536	—	A `.mcp.json` in an untrusted directory executed shell commands at tool init ^[15]	Fixed
CVE-2026-21852	—	A repo-set `ANTHROPIC_BASE_URL` leaked API keys before the trust prompt rendered ^[15]	Fixed
CVE-2025-66032	8.7	PR titles interpolated into the GitHub Action prompt unsanitised; malicious issue bodies got the agent to read `/proc/self/environ` ^[16]	Fixed
CVE-2026-39861	7.7	A sandboxed process created a symlink out of the workspace; a later unsandboxed write followed it to `~/.bashrc` or cron ^[14]	Fixed 2.1.64
CVE-2026-35020 /35021/35022	chain	Env-var command injection gains execution → writes a malicious `.claude/settings.json` `apiKeyHelper` → on next start it reads `~/.ssh/id_rsa` and `~/.aws/credentials` and POSTs them out ^[17]	Fixed (chain)
No CVE assigned	—	SOCKS5 hostname null-byte parser differential: `attacker.com\x00.google.com` passes `endsWith()` and resolves to `attacker.com`. Vulnerable v2.0.24 → v2.1.89 — roughly 130 releases over 5.5 months ^[13]	Silently patched v2.1.90
No CVE assigned	—	Hard cap of 50 security subcommands in `bashPermissions.ts`: 50 no-ops plus a denied `curl` downgrades deny to ask — and users approve 93% of asks ^[23]	Unpatched publicly · Apr 2026

Research write-up on Claude Code data exfiltration via DNS requests — Exhibit 9 — DNS is egress. Disclosed 26 May 2025, fixed 6 June ^[12]

Research write-up on a second network allowlist bypass in the Claude Code sandbox — Exhibit 10 — "One outside report is luck. Two is implementation." ^[13]

Phoenix Security analysis of three chained CVEs in the Claude Code CLI — Exhibit 11 — the config-write → `apiKeyHelper` → SSH-key chain ^[17]

Part IV

Likelihood × blast radius

The ranking that containment should be built against. Chit border tells you how much of the assessment is victim data and how much is laboratory work — the single most important distinction in this file, because PoC-led risks are real but not where your first hour of hardening goes.

Blast radius ↓
Likelihood →

Low

Medium

High

Beyond the machinegit remotes → CI → production, with backups

Rank 7 · adjacentAgent reaches a live production system through a stray token

Rank 3 · confirmedCredential exfil — SSH key, cloud creds, tokens — via injection or a poisoned config

—

Whole user accounteverything $HOME can reach

Rank 9 · confirmedMalicious installer or fake "leaked" build

Slopsquatting · PoCHallucinated package names, registered and waiting — 43% recur on every one of ten identical runs ^[26], and the academic PoC used "harmless placeholders, not real malware" ^[25]

Rank 4 · PoC-ledInjection via content the agent fetches — page, README, issue. Exposure is rising: a measured 32% relative increase in malicious injection content Nov 2025 → Feb 2026 across 2–3 billion pages a month ^[11]

Rank 5 · confirmedThird-party MCP server, malicious or merely sloppy

Rank 6 · PoC-ledUntrusted-repo cold start — one cd away

Rank 1 · confirmedMalicious dependency executed by a build the agent runs

This working treethe repo in front of you

Not observedModel misalignment — agent pursuing its own goal ^[1]

—

Rank 2 · confirmedAgent destroys uncommitted / unpushed work

Realized harm, CLI victims

Realized harm, other agent product

Proven end-to-end, researcher PoC

Named but not observed in practice

Off the matrix — Rank 8, certainty 1.0

Data leaving through the agent's legitimate channel doesn't belong in a likelihood grid: it is certain, by design, and containment cannot fix it. Only configuration can. See Part VI.

Part V

Analyst notes — what's overstated

Four places where the public numbers are softer than they look. Reading the register above without these produces a threat model calibrated to headlines.

MCP vulnerability percentages are soft

A hands-on audit of 33 local MCP servers (433 tools) found a ~78% false-positive rate in pattern-based MCP scanners — only 6 of 27 flagged detections were genuine, and all 8 "prompt injection" hits were false ^[21]. Treat the 34% command-injectable / 82% path-traversal-prone / 36.7% SSRF figures ^[20] as upper bounds on attack surface, not on exploitability.

Least-bad of its peers is not safe

The 2026 systematic analysis of agentic coding assistants rates the CLI Low risk and editor-integrated agents far worse — while also measuring that adaptive attacks exceed 85% success and that all 12 evaluated defenses were bypassed at >78% ^[22]. Both readings are true at once.

Claude CodeLow

Codex CLIHigh

CopilotHigh

CursorCritical

Anthropic report on disrupting an AI-orchestrated cyber espionage campaign — Exhibit 12 — GTG-1002 ^[28]

Guardrails degrade the attacker; they don't stop them

In the s1ngularity campaign roughly 25% of Claude invocations were refused outright and the AI-assisted path succeeded in under 25% of cases — and it still produced 2,000+ verified secrets ^[6]. A refusal rate is a tax on the attacker, not a boundary.

"AI-orchestrated attack" headlines are about the CLI as a weapon

GTG-1002 (Nov 2025) was a state actor jailbreaking the CLI to attack ~30 organisations with 80–90% of tactical work automated ^[28]. That matters for how fast an adversary moves after they have your keys. It is not a workstation threat in itself, and confusing the two inflates the local risk picture.

Part VI

Standing data flow — not a breach

Per the vendor's own data-usage documentation ^[10]. Worth separating from attacks because no sandbox addresses it — this is a settings decision, made once. ☐ = there is a switch. ⊠ = there is no switch.

Disposition of outbound data

Prompts, model outputs, and every file the agent reads in full go over TLS to the model API. This is the product working.
Telemetry and metrics never include code, prompts, or file paths — and can be turned off entirely with DISABLE_TELEMETRY=1.
/feedback, /bug and /share do send conversation history including code, optionally opening a public issue. Disable with DISABLE_FEEDBACK_COMMAND=1.
WebFetch sends the target hostname to the vendor API for a blocklist check regardless of which model provider you use — and this is not covered by CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC.

Local half — this is the part that matters for blast radius Session transcripts are cached in plaintext under ~/.claude/projects/ for 30 days by default ^[10]. Any infostealer that reads that directory gets a replay of every file the agent touched, including secrets it printed — which is exactly why the credential-stealer families target agent config paths. On consumer accounts with the training toggle on, server-side retention is 5 years.

Part VII

Containment tasking

Derived from Part IV, in priority order. This file specifies the requirement only; each one is referred to a sibling file in the same case for the mechanism.

1

Writes outside the working tree must be structurally impossible Including via symlink ^[14]. This is what protects ~/.bashrc, cron, and the agent's own .claude/settings.json ^[17].

Referred toLinux-native sandboxing on the workstation

2

Uncommitted work must survive the agent Because git reset --hard will happen, and those reports are closed as not planned ^[2]^[3].

Referred toAudit trail and recovery drills

3

Long-lived credentials must not be readable from the agent's process ~/.ssh/id_rsa, ~/.aws/credentials, git remotes' push tokens, and any stray API token in an unrelated file ^[24].

Referred toCredential isolation for an agentic coding CLI

4

Egress must be enforced below the agent At the kernel or network layer, because in-process allowlists have been bypassed twice by outside researchers on first look ^[13] and deny rules can be padded out of existence ^[23]. DNS counts as egress ^[12].

Referred toProxmox as the isolation boundary

5

npm install and build steps need the same boundary as the agent Since the dependency, not the model, is the highest-likelihood attacker ^[7]^[8].

Referred toContainers as the containment layer

6

Third-party MCP servers deserve dependency-grade review And their config file (~/.claude.json) deserves integrity monitoring — a postinstall hook rewriting MCP URLs proxies OAuth exchanges and survives token rotation ^[18]^[19].

Referred toNative guardrails and the permission model

Out of scope in this file: the CLI's own permission and sandbox features, Linux-native sandboxing primitives, container isolation, Proxmox VM/LXC separation, credential-isolation patterns, and audit/recovery tooling. All of those are sibling files in the same case — the folder tabs below.

Case

Other files in this case

Native guardrails & permission modelexpedition · in-process policy, not a boundary Linux-native sandboxingexpedition · bubblewrap, namespaces, Landlock Containerized dev environmentssurvey · rootless Podman, proxy-only network Proxmox as the isolation boundaryexpedition · KVM VM, never LXC Credential & secret isolationsurvey · short-lived, narrowly scoped Audit trail & recovery drillsrecon · commits are the real undo

What actually goes
wrong (and what only
goes wrong in a lab)

The room this happens in

Why prompting cannot fix it

Confirmed incidents — realized 2026 losses

The agent's own destructive `git`

Malware that weaponised the installed CLI

The dependency, not the model, is the attacker

A backdoored MCP server, shipped and installed

Stray token → production wiped, backups included

Attacked before the binary ever runs

Vulnerability register

Likelihood × blast radius

Off the matrix — Rank 8, certainty 1.0

Analyst notes — what's overstated

MCP vulnerability percentages are soft

Least-bad of its peers is not safe

Guardrails degrade the attacker; they don't stop them

"AI-orchestrated attack" headlines are about the CLI as a weapon

Standing data flow — not a breach

Disposition of outbound data

Containment tasking

Other files in this case

Source register · 28 entries

What actually goeswrong (and what onlygoes wrong in a lab)

The room this happens in

Why prompting cannot fix it

Confirmed incidents — realized 2026 losses

The agent's own destructive git

Malware that weaponised the installed CLI

The dependency, not the model, is the attacker

A backdoored MCP server, shipped and installed

Stray token → production wiped, backups included

Attacked before the binary ever runs

Vulnerability register

Likelihood × blast radius

Off the matrix — Rank 8, certainty 1.0

Analyst notes — what's overstated

MCP vulnerability percentages are soft

Least-bad of its peers is not safe

Guardrails degrade the attacker; they don't stop them

"AI-orchestrated attack" headlines are about the CLI as a weapon

Standing data flow — not a breach

Disposition of outbound data

Containment tasking

Other files in this case

Source register · 28 entries

What actually goes
wrong (and what only
goes wrong in a lab)

The agent's own destructive `git`