Disclosed vulnerability
Untrusted project-local filters in RTK: a committed .rtk/filters.toml controls what the coding agent is allowed to see
AIR-2026-0118 AIR record · 2026-05-rtk-untrusted-project-filters
From the supporting source
An attacker who controls the filtering layer doesn't need to inject anything into the model's context, only remove the evidence of what they've planted.pillar.security
The record
Disclosed
2026-05-20
Vendor
RTK maintainers (open source)
Product
RTK (token optimization layer for Claude Code)
Risk domain
Access control and permissions › Privilege escalation
Also touches
Policy drift, Confused deputy
System type
Generative model
Who acted
Agent acted (contested) — the filter layer blinds the agent, which then acts on falsified evidence
Attack surface
Coding agent
Autonomy level
Semi-autonomous
Initial vector
Malicious repository config file
Impact type
Defense evasion, Integrity violation
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
RTK users (50k+ GitHub stars) opening untrusted repositories
Capability abused
Defense & remediation
Recorded defense
none - project-local filters were loaded automatically without approval or warning
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
RTK v0.33.0 (2026-03-25): hash-based integrity verification, untrusted filters blocked by default, explicit `rtk trust` opt-in
Taxonomy & references
Curator notes
Pillar Security (Ariel Fogel). Reported 2026-03-15, patched 2026-03-25, CVE-2026-45792 (CVSS 4.0 score 6.9) disclosed 2026-05-20. Categorically different from prompt injection: this attacks the agent's perception layer by subtraction, hiding backdoors from AI code review and security scanning rather than adding instructions.
Supporting sources
Cite as
Enkrypt AI. "Untrusted project-local filters in RTK: a committed .rtk/filters.toml controls what the coding agent is allowed to see". AIR, AIR-2026-0118. https://agentincident.vercel.app/i/AIR-2026-0118/ (accessed 2026-10-19).