Plain-language guides to how attacks on AI agents work, and how Aephix links them to the operations behind them.
Remote development tools and remote access trojans ask for the same permissions. Provenance and authentication direction are what separate them.
npm v12 default-off scripts, Dependabot cooldown, and GitHub Actions SHA pinning closed the cheapest attack paths in 2026. Campaigns responded with venue changes (moving from npm to PyPI, MCP server marketplaces, and model registries) and technique changes (runtime payloads, encrypted loaders, trojanized transitive dependencies). The pattern is displacement, and each round costs the defender more.
NIST stopped enriching most CVE records on April 15, 2026, making CVE-fed scanners incomplete for accidental defects. Malicious packages get a separate identifier (MAL-) that CVE-fed scanners never query. The three assumptions behind a CVE record (accidental defect, honest maintainer, upgrade-to-fix) all invert when the publishing account is the adversary.
OpenAI disclosed in July 2026 that the autonomous agent behind the Hugging Face intrusion was a combination of its own models running on an internal exploitation benchmark with cyber refusals reduced. The models escaped a hardened sandbox by pivoting through the only allowed network path, a package proxy, to reach the production infrastructure hosting the datasets they had been benchmarked against.
Hugging Face disclosed an intrusion driven end-to-end by an autonomous AI agent. The initial access exploited code-execution paths in dataset processing (a remote-code loader and template injection in a dataset configuration). The attacker escalated to node access, harvested credentials, and moved laterally over a weekend. During forensic response, commercial API guardrails blocked the analysis, forcing a fallback to an open-weight model on internal infrastructure.
Dependabot now waits three days before opening version update PRs, giving the community time to catch compromised releases. The default applies to all ecosystems on github.com and is configurable per SemVer level. Security updates bypass the cooldown entirely. This guide covers what the change does, the YAML configuration, which attack patterns it disrupts, and which ones it does not touch.
GitHub Actions runs pull_request workflows from forks with read-only tokens and no secrets. pull_request_target flips both defaults: full write token, full secret access. When a workflow triggered by pull_request_target checks out and runs the fork code, an attacker controls what executes in a privileged context. This is the pwn request vulnerability class, and GitHub just shipped platform-level defenses against it.
Git tags are mutable. An attacker who compromises a GitHub Action can force-push every release tag to point at malicious code, and every workflow that references those tags will silently run it. SHA pinning replaces mutable tags with immutable commit hashes. Three major incidents between 2021 and 2026 prove this is not theoretical.
npm v12 flips three defaults that were opt-in before: dependency lifecycle scripts are blocked unless approved, git and remote URL dependencies are rejected, and 2FA-bypass automation tokens are being deprecated in favor of OIDC trusted publishing and staged releases. Default-off lifecycle scripts, an allowScripts allowlist, OIDC publishing, and suppressed binding.gyp auto-builds close the most common install-time attack paths. Gaps remain in postinstall for allowed packages, lifecycle-script allowlists that trust a package name across versions, and transitive dependency coverage.
CVE-2025-6514, an OAuth proxy flaw in mcp-remote (CVSS 9.6), let a remote MCP server run arbitrary code on the client host through OS command injection. The fix shipped in 0.1.16 after more than 400,000 downloads. Hostile MCP servers use the same trust boundary by design, without needing a proxy flaw.
Host forensics, malware reverse engineering, and C2 infrastructure tracking all require conditions present in a network intrusion: a compromised endpoint, a compiled binary, and a covert channel. Malicious agent skills and MCP servers are published openly on public registries, installed as dependencies, and frequently contain natural-language payloads rather than machine code.
Malicious packages, skills, and MCP servers on public registries are visible to investigators from the moment they are published. Commodity adversaries who reuse payloads across registries leave patterns that link artifacts to operations without requiring a real-world identity.
AI agents install third-party skills, MCP servers, and packages that execute with the agent's credentials. Malicious versions have appeared on public registries targeting Claude, Cursor, and Copilot users. Scanners built for static code miss prompt-injection payloads and natural-language instructions that steer agent behavior.