CERT-EU demonstrates backdoor risks in third-party extensions of AI agent frameworks

1. 10:38
   WeChat · Oxo Security

   Why can't tool approval stop plugin code? Examining the agent's execution boundary through the CERT-EU experiment

   Research published by CERT-EU on October 30, 2026 shows that tool approval only constrains calls initiated by the model and cannot stop code run by the plugin itself. In an isolated lab, researchers modified local copies of two existing plugins, Pi 1.3.0 and Claude Code 2.1.304, and used test credentials to observe collection and exfiltration; an ordinary code review phrase triggered the pre-embedded logic, the two agents' conversation remained normal with no malicious model tool calls, yet the receiving end received the requests. The authors therefore point out that approval checks what the model requested, whereas a plugin can directly invoke system capabilities on the event path, and propose a deployment self-check method that verifies three points: execution identity, resource visibility and network egress; they also note that tool logs record only model requests and cannot prove that the plugin process did not exfiltrate data.

1. 21:29
   X@OKURA_Labs· Discussion

   Agent controls govern what the model asks to do. A lab test found a hidden routine in a legitimate add-on that collecte…(opens the original post in a new tab)

1. 19:40
   CERT-EUSelected

   Beyond the model: backdoors in AI agent harnesses

   The CERT-EU AI team demonstrated in an isolated experiment that a third-party extension loaded by an AI agent harness can be implanted with a trigger-based backdoor that steals sensitive host information without the language model participating at all. The experiment targeted two harnesses, Pi 1.3.0 and Claude Code 2.1.304, inserting credential-collection code into the event-handling paths of two widely installed legitimate extensions (one of which has about 1.6 million downloads per month), modifying only local copies and not changing or distributing the public versions. The backdoor activates only when a preset trigger phrase (an ordinary code review phrase) appears in the input, transmitting host and virtual machine information, user accounts, network configuration, environment variables and credential-related files in the working directory to a configured collection endpoint, while the agent conversation proceeds as usual with no visible malicious tool calls. In the test configuration, controls restricting model file reading did not apply to files directly accessed by plugin event handlers, and controls reviewing model tool calls also failed to intercept, because the operations did not originate from tool calls.

Current attention 42·Peak in the comparable period 43 (Nov 6 03:00)·Change over the comparable past 24 hours –