# CERT-EU: a backdoored agent plugin never touches the model

> Extensions run beside the model with the developer's permissions, so a backdoored plugin needs no prompt injection to steal credentials.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Research, Supply chain
- **Published by:** CERT-EU
- **Disclosed:** 2026-10-30
- **Affects:** Claude Code, pi
- **Research by:** CERT-EU AI team
- **Primary source:** https://cert.europa.eu/blog/beyond-the-model-backdoors-in-ai-agent-harnesses
- **Page:** https://theinjection.dev/items/certeu-agent-harness-backdoors/

CERT-EU modified plugins for Claude Code and pi so that a trigger phrase in user input sent host data to a collection endpoint. No tool call appeared, the conversation looked normal, and the agents' approval prompts never saw it.

## What happened

CERT-EU's AI team published the experiment on October 30, 2026, separating two attack surfaces for AI coding agents: the model layer, where weights are backdoored, and the harness layer, where the code that executes an agent's tool calls is tampered with. The team modified local copies of two legitimate third-party packages used with Claude Code and pi. No public release was altered, and the post does not name the packages.

## How it works

Harness extensions register event hooks that the agent runs itself, outside the model's tool call path. CERT-EU changed those hooks so that a payload fired when a configured trigger phrase appeared in user input, gathering host credentials and sending them to a collection endpoint. Both harnesses loaded and ran the modified handlers through their normal install mechanism, with no runtime override. On ordinary prompts the plugins worked as expected and nothing reached the collector.

## Who is affected

Teams running AI coding agents with third-party plugins, extensions or skills are in scope, because those components execute with the developer's permissions. CERT-EU argues that tool permissions and approval prompts govern what the model does, not code running next to it, which can give a false sense of containment.

## What to do

Keep an inventory of agent plugins, pin their versions and review changes before updating, treating each as privileged executable software whatever its popularity or source. CERT-EU also recommends running agents in dedicated VMs, containers or restricted accounts away from SSH agents, browser profiles and credential stores, using short-lived narrowly scoped credentials instead of long-lived keys in environment variables, restricting outbound traffic, and monitoring extension installs and sensitive file access rather than tool calls alone.

## Quick facts

- **Harnesses tested:** Claude Code and pi
- **Method:** Event hooks in modified local copies of two legitimate third-party packages, names not published
- **Trigger:** A configured phrase in user input; ordinary prompts sent nothing
- **Visibility:** No tool call shown for credential access or transmission
- **Published:** October 30, 2026, on the CERT-EU blog

## Sources

1. [CERT-EU Blog Post](https://cert.europa.eu/blog/beyond-the-model-backdoors-in-ai-agent-harnesses)
2. [CERT-EU GenAI Guidance](https://cert.europa.eu/publications/security-guidance/generative-ai-in-cybersecurity-balancing-innovation-and-risk/)