> For the complete documentation index, see [llms.txt](https://handbook.harmonic.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://handbook.harmonic.security/handbook/5.-threats-and-adversarial/5.3-supply-chain-attacks-and-notable-cves.md). # 5.3 Supply chain attacks and notable CVEs AI supply-chain attack patterns and CVEs involving repositories, MCP configurations, packages, extensions, hooks, clients, and agent runtimes. *Last reviewed: August 18, 2026* {% hint style="info" %} AI coding tools turn repositories and configuration into active inputs. Opening a project can become part of the attack path. {% endhint %} ## Supply chain attacks and notable CVEs: what security teams need to know AI supply-chain attacks often use trusted developer workflows. A repository may include configuration, hooks, MCP settings, or prompt files that influence the agent after the user opens the project. The pattern is no longer hypothetical. The CVEs and incidents below cluster around one theme: the tooling around the agent (MCP clients, debug proxies, IDE integrations, and the package ecosystem) is the attack surface, not the model. ## Notable CVEs and incidents | Identifier | What happened | Fix / status | | ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ | | CVE-2025-6514 (mcp-remote) | OS command injection in the mcp-remote client via a malicious MCP server's OAuth authorization endpoint (CVSS 9.6). | Fixed in mcp-remote 0.1.16. | | CVE-2025-49596 (MCP Inspector) | Browser-triggered remote code execution through the MCP Inspector's unauthenticated local proxy (CVSS 9.4). | Fixed in MCP Inspector 0.14.1. | | CVE-2025-52882 (Claude Code IDE extensions) | Unauthorized WebSocket connections from arbitrary origins to Claude Code IDE extensions (CVSS 8.8). | Patched in June 2025. | | Nx "s1ngularity" npm compromise | Compromised Nx packages shipped malware that invoked installed AI CLIs with permission-bypass flags to harvest credentials, collecting roughly 2,349 secrets. | Disclosed August 2025. | The Nx incident deserves particular attention: the malware did not exploit the AI CLIs, it invoked them with their own permission-bypass flags. That makes restricting those flags on managed machines a supply-chain control, not just an autonomy preference. ## Common supply chain attacks and notable CVEs security failures * A repository carries a hook that executes during an agent session. * MCP configuration points to an attacker-controlled server. * A base URL override sends credentials to the wrong service. * Project prompt files instruct the agent to weaken controls. * A dependency update changes a tool used by the agent. ## Supply chain attacks and notable CVEs security controls checklist * Treat project configuration as executable trust. * Require workspace trust before project-level settings take effect. * Review hooks, MCP configs, plugin files, and prompt files in external repositories. * Block or review base URL overrides and credential helpers. * Track CVEs and vendor advisories for AI tooling, and re-review this class of dependency on a shorter cadence than the rest. ## Anthropic ### Overview Anthropic supply-chain review should include Claude Code settings, hooks, plugins, skills, MCP servers, repository instructions, Desktop extensions, Agent Skills, and Managed Agent definitions. A malicious repository, skill script, plugin, MCP server, or extension can alter what Claude reads, runs, or trusts. The package-like objects are concrete: Claude Code plugins can package skills, agents, hooks, MCP servers, and commands in one install; skills are SKILL.md files that can ship supporting scripts and pre-approved tools; and desktop extensions are MCP Bundles (.mcpb) containing a local MCP server and a manifest describing its capabilities. Managed settings can restrict MCP servers, plugins, hooks, permission rules, and sandbox behavior organization-wide. CVE-2025-52882, which allowed unauthorized WebSocket connections from arbitrary origins to Claude Code IDE extensions and was patched in June 2025, is the reminder that the IDE integration layer itself belongs in scope. ### Anthropic documentation * [Claude Code settings](https://code.claude.com/docs/en/settings) * [Claude Code security](https://code.claude.com/docs/en/security) * [Claude Code hooks](https://code.claude.com/docs/en/hooks) * [Claude Code plugins](https://code.claude.com/docs/en/plugins) * [Extend Claude with skills](https://code.claude.com/docs/en/skills) * [Building Desktop Extensions with MCPB](https://github.com/modelcontextprotocol/mcpb) * [Claude Managed Agents overview](https://platform.claude.com/docs/en/managed-agents/overview) ## OpenAI ### Overview OpenAI supply-chain review should include ChatGPT apps and custom MCP apps, Apps SDK servers, Codex plugins and marketplaces, direct Codex MCP config, Agents SDK packages, exported Agent Builder workflows, and Codex SDK/MCP orchestration. Track source, version, manifest, tool list, credentials, and update path for each package-like object. Two Codex surfaces can trigger when a repository is opened: hooks are discovered from hooks.json files next to active config layers, including repo-local .codex directories, and skills are reusable instructions with optional helper scripts that can be bundled and distributed through plugins. Codex hooks are experimental and gated behind a config feature flag, and pre-tool interception currently covers only simple shell calls, so treat it as a guardrail, not a complete enforcement boundary. Plugins can be published through marketplace sources such as a repo marketplace, and uninstalling a plugin leaves bundled apps installed in ChatGPT until they are removed there. Where exported Agent Builder workflows appear in inventories, note that OpenAI documents Agent Builder as legacy, with shutdown scheduled for November 30, 2026. ### OpenAI documentation * [Codex hooks](https://developers.openai.com/codex/hooks) * [Codex skills](https://developers.openai.com/codex/skills) * [Plugins](https://learn.chatgpt.com/docs/plugins) * [Agent Builder](https://developers.openai.com/api/docs/guides/agent-builder) ### Applicable Harmonic guides for OpenAI * [Securing Codex Best Practice](https://www.harmonic.security/resources/securing-codex-best-practice) ## Frequently asked questions about supply chain attacks and notable CVEs ### What is an AI supply-chain attack? It is an attack that changes the code, configuration, tool, prompt, package, or extension an AI workflow depends on. Instead of attacking the model, the attacker poisons something the agent will read or execute: a hook, an MCP server, a plugin, or a dependency. OWASP counts supply chain vulnerabilities among its Top 10 risks for LLM applications, and the 2025 incidents on this page all followed that pattern. ### Why are repositories risky for AI agents? They can contain instructions and configuration that influence tool access, hooks, MCP servers, and generated changes. Some of it activates when the project is opened: Claude Code project-scoped settings and Codex repo-local hooks and skills are read from the repository itself. Workspace trust and managed settings exist to gate exactly this. ### Which CVEs have hit MCP and AI coding tools? The most cited 2025 examples are CVE-2025-6514, an OS command injection in the mcp-remote client via a malicious MCP server's OAuth authorization endpoint (CVSS 9.6, fixed in 0.1.16); CVE-2025-49596, browser-triggered remote code execution through the MCP Inspector's unauthenticated local proxy (CVSS 9.4, fixed in 0.14.1); and CVE-2025-52882, unauthorized WebSocket connections from arbitrary origins to Claude Code IDE extensions (CVSS 8.8, patched June 2025). The August 2025 Nx "s1ngularity" npm compromise added the incident pattern: malware invoking installed AI CLIs with permission-bypass flags, harvesting roughly 2,349 secrets. ### What files should reviewers check? Check hooks, MCP configs, plugin manifests, skills, prompt files, dependency manifests, and credential helpers. In Claude Code that means settings files, hooks, plugins, and SKILL.md files; in Codex it means repo-local .codex directories, hooks.json, skills, and plugin marketplace sources. Base URL overrides and credential helpers deserve special attention because they redirect secrets rather than run code. ### How should teams reduce trigger-on-open risk? Use workspace trust, managed settings, deny rules, source review, and isolated environments for unknown repositories. Open unfamiliar projects in a sandbox or disposable environment before letting project-level settings take effect. On managed machines, enforce configuration centrally so a repository cannot quietly re-enable what policy disabled. ## Applicable regulations and frameworks | Governance page | Relationship to this article | | --------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | | G.1 Map your controls to NIST AI RMF and CSF 2.0 | This article supplies implementation evidence for the NIST AI RMF and matching NIST CSF 2.0 outcomes. | | G.3 DORA and AI resilience in financial services | Conditional: for a DORA-regulated workflow, this supports resilience testing, vulnerability handling, and incident response. | | G.5 SANS Critical AI Security Guidelines mapping | This article implements relevant SANS Inference Security, Monitoring, and GRC guidance. | | G.6 Write an AI Acceptable Use Policy that holds up | This article supplies a technical or process control used to enforce the acceptable-use policy. | | G.9 HIPAA controls for AI systems handling PHI | Conditional: for a workflow handling ePHI, this supports HIPAA risk analysis, safeguard testing, and security-incident response. | *G.2, G.3, G.4, and G.9 are conditional mappings. They apply only when the deployment is within the legal or regulatory scope described on the linked governance page.* ## Related handbook guidance * [5. Threats & Adversarial](/handbook/5.-threats-and-adversarial.md) * [2.4 Analyzing skills for risk](/handbook/2.-supply-chain-and-extensibility/2.4-analyzing-skills-for-risk.md) * [2.5 Plugins and marketplaces](/handbook/2.-supply-chain-and-extensibility/2.5-plugins-and-marketplaces.md) * [2.8 Signing and packaging](/handbook/2.-supply-chain-and-extensibility/2.8-signing-and-packaging.md) * [5.6 Incident response for AI system](/handbook/5.-threats-and-adversarial/5.6-incident-response-for-ai-system.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://handbook.harmonic.security/handbook/5.-threats-and-adversarial/5.3-supply-chain-attacks-and-notable-cves.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.