CERT-EU: a backdoored agent plugin never touches the model
Extensions run beside the model with the developer's permissions, so a backdoored plugin needs no prompt injection to steal credentials.
· CERT-EU · Research by CERT-EU AI team
CERT-EU modified plugins for Claude Code and pi so that a trigger phrase in user input sent host data to a collection endpoint. No tool call appeared, the conversation looked normal, and the agents' approval prompts never saw it.
01What happened
CERT-EU's AI team published the experiment on October 30, 2026, separating two attack surfaces for AI coding agents: the model layer, where weights are backdoored, and the harness layer, where the code that executes an agent's tool calls is tampered with. The team modified local copies of two legitimate third-party packages used with Claude Code and pi. No public release was altered, and the post does not name the packages.
02How it works
Harness extensions register event hooks that the agent runs itself, outside the model's tool call path. CERT-EU changed those hooks so that a payload fired when a configured trigger phrase appeared in user input, gathering host credentials and sending them to a collection endpoint. Both harnesses loaded and ran the modified handlers through their normal install mechanism, with no runtime override. On ordinary prompts the plugins worked as expected and nothing reached the collector.
03Who is affected
Teams running AI coding agents with third-party plugins, extensions or skills are in scope, because those components execute with the developer's permissions. CERT-EU argues that tool permissions and approval prompts govern what the model does, not code running next to it, which can give a false sense of containment.
04What to do
Keep an inventory of agent plugins, pin their versions and review changes before updating, treating each as privileged executable software whatever its popularity or source. CERT-EU also recommends running agents in dedicated VMs, containers or restricted accounts away from SSH agents, browser profiles and credential stores, using short-lived narrowly scoped credentials instead of long-lived keys in environment variables, restricting outbound traffic, and monitoring extension installs and sensitive file access rather than tool calls alone.
Sources 2 links, all fetched
- 1cert.europa.euCERT-EU Blog Post
- 2cert.europa.euCERT-EU GenAI Guidance