Beyond the model: backdoors in AI agent harnesses

CERT-EU examined how malicious code in an AI-agent extension can operate with the user’s permissions without requiring the language model to generate a malicious tool call. In isolated lab tests, local copies of two legitimate third-party packages were modified with a trigger-activated credential-collection mechanism.