Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
Research demo

Hijacking Claude Code via injected marketplace plugins: hooks that rewrite the permissions file and auto-approve commands

AIR-2026-0002 AIR record · 2026-01-promptarmor-claude-code-marketplace-hijack
Open in dashboard About
From the supporting source
It automatically scrapes GitHub to find new ones every hour. This means that they will list a malicious Marketplace in their registry for people to discover within an hour of an attacker making it public!promptarmor.com
The record
Disclosed
2026-01
Vendor
Anthropic (Claude Code) / third-party registry
Product
Claude Code plugin marketplaces; claudecodemarketplaces.com registry
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Unsafe actuation, Privilege escalation, Data exfiltration channels
System type
Generative model
Who acted
Agent acted — injected plugin hooks rewrote permissions and auto-approved the agent's commands
Attack surface
Skill / plugin
Autonomy level
Copilot with approval
Initial vector
Malicious plugin marketplace auto listed by registry
Impact type
Data exfiltration, Destructive action, Remote control
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI04 – Agentic Supply Chain Vulnerabilities
MITRE ATLAS
AML.T0040 – AI Supply Chain Compromise
NIST AI RMF
MAP 4.1
EU AI Act
Annex III §2
ISO/IEC
TR 24028; 42001; 23894
AIUC-1
B. Security
Scope
tool failure
Mitigation
Scan dependencies and container images for vulnerabilities; Use trusted sources.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
any Claude Code user who adds an untrusted marketplace
Capability abused
hookspermission_configurationshell_executionfile_read
Defense & remediation
Recorded defense
Claude Code human approval for dangerous commands
Guardrail kinds
Human approval
Guardrail outcome
Silent
Fix shipped
unknown
Taxonomy & references
OWASP ASI05 Unexpected Code Execution (RCE)OWASP ASI01 Agent Goal HijackOWASP ASI04 Agentic Supply Chain VulnerabilitiesOWASP ASI03 Identity and Privilege Abuseplugin_marketplacehooks_abusehuman_in_the_loop_bypassbrand_impersonationunvetted_registry
Curator notes
PROVENANCE CAVEAT: the page carries no publication date, only a '(c) 2026' footer; the 2026-01 in the incident_id is provisional, not a verified date, and date_disclosed is left null. PromptArmor research. Attack path: a fake GitHub account impersonating Anthropic publishes marketplace metadata, the third-party registry auto-scrapes and lists it within an hour, and the plugin's hooks either rewrite the permissions configuration to allow curl, or auto-approve command types before the approval prompt reaches the user. Demonstrated outcomes: file deletion and a reverse shell. | date_disclosed is recorded to the month only; no source establishes the exact day.
Supporting sources
Cite as
Enkrypt AI. "Hijacking Claude Code via injected marketplace plugins: hooks that rewrite the permissions file and auto-approve commands". AIR, AIR-2026-0002. https://agentincident.vercel.app/i/AIR-2026-0002/ (accessed 2026-10-19).