Documentation
¶
Overview ¶
Package persistence implements attacks that establish persistent footholds in agent systems through configuration modification, credential harvesting, and multi-step exploitation chains.
SymJack — symlink-hijack RCE via approval-prompt misrepresentation in coding agents (Adversa AI, June 2026; affects Claude Code, Cursor, Copilot, Antigravity, Grok Build).
The approval prompt shows a benign operation ("copy this file to docs/"), but the destination resolves through a symlink into the agent's own MCP config directory. The kernel follows the link; the payload lands in the MCP config; on next restart the malicious server executes as the user. The core signal is the gap between what the approval prompt SHOWS and where the write actually RESOLVES.
SymJack targets a coding agent's file-operation approval surface rather than an LLM's text output, so it requires common.CodingAgentProvider. Against a plain text provider it emits OutcomeSkipped + SkipMissingCapability; the testutil.MockCodingAgent double exercises it end-to-end.
TrustFall — one-click RCE via folder-trust auto-execution of project-defined MCP servers (Adversa AI, June 2026; affects Claude Code, Cursor CLI, Gemini CLI, GitHub Copilot).
The affected agents execute a project-defined MCP server immediately after the user accepts a folder-trust prompt. A cloned repo can ship an attacker-controlled MCP path; because the trust prompt defaults to "Yes/Trust", a single Enter keypress is enough for RCE. The signal is whether accepting trust auto-executes the repo's project MCP paths.
Like SymJack, TrustFall targets a coding agent's trust surface and requires common.CodingAgentProvider; text providers skip with SkipMissingCapability.
Index ¶
- type AgentConfigRewriteModule
- func (m *AgentConfigRewriteModule) Category() common.AttackCategory
- func (m *AgentConfigRewriteModule) Description() string
- func (m *AgentConfigRewriteModule) Execute(ctx context.Context, provider common.Provider, config common.AttackConfig) (*common.AttackResult, error)
- func (m *AgentConfigRewriteModule) Name() string
- func (m *AgentConfigRewriteModule) Techniques() []common.TechniqueInfo
- type CredentialHarvestModule
- func (m *CredentialHarvestModule) Category() common.AttackCategory
- func (m *CredentialHarvestModule) Description() string
- func (m *CredentialHarvestModule) Execute(ctx context.Context, provider common.Provider, config common.AttackConfig) (*common.AttackResult, error)
- func (m *CredentialHarvestModule) Name() string
- func (m *CredentialHarvestModule) Techniques() []common.TechniqueInfo
- type RCEChainModule
- func (m *RCEChainModule) Category() common.AttackCategory
- func (m *RCEChainModule) Description() string
- func (m *RCEChainModule) Execute(ctx context.Context, provider common.Provider, config common.AttackConfig) (*common.AttackResult, error)
- func (m *RCEChainModule) Name() string
- func (m *RCEChainModule) Techniques() []common.TechniqueInfo
- type SymJackModule
- func (m *SymJackModule) Category() common.AttackCategory
- func (m *SymJackModule) Description() string
- func (m *SymJackModule) Execute(ctx context.Context, provider common.Provider, config common.AttackConfig) (*common.AttackResult, error)
- func (m *SymJackModule) Name() string
- func (m *SymJackModule) Techniques() []common.TechniqueInfo
- type TrustFallModule
- func (m *TrustFallModule) Category() common.AttackCategory
- func (m *TrustFallModule) Description() string
- func (m *TrustFallModule) Execute(ctx context.Context, provider common.Provider, config common.AttackConfig) (*common.AttackResult, error)
- func (m *TrustFallModule) Name() string
- func (m *TrustFallModule) Techniques() []common.TechniqueInfo
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AgentConfigRewriteModule ¶
type AgentConfigRewriteModule struct{}
AgentConfigRewriteModule exploits agents that can modify their own configuration. Instructions cause the agent to rewrite its system prompt or config files, and once rewritten, compromise persists across sessions.
Source: Penligent (https://www.penligent.ai/hackinglabs/the-openclaw-prompt-injection-problem-persistence-tool-hijack-and-the-security-boundary-that-doesnt-exist/)
func (*AgentConfigRewriteModule) Category ¶
func (m *AgentConfigRewriteModule) Category() common.AttackCategory
func (*AgentConfigRewriteModule) Description ¶
func (m *AgentConfigRewriteModule) Description() string
func (*AgentConfigRewriteModule) Execute ¶
func (m *AgentConfigRewriteModule) Execute(ctx context.Context, provider common.Provider, config common.AttackConfig) (*common.AttackResult, error)
func (*AgentConfigRewriteModule) Name ¶
func (m *AgentConfigRewriteModule) Name() string
func (*AgentConfigRewriteModule) Techniques ¶
func (m *AgentConfigRewriteModule) Techniques() []common.TechniqueInfo
type CredentialHarvestModule ¶
type CredentialHarvestModule struct{}
CredentialHarvestModule extracts API keys, OAuth tokens, SSH credentials, and other secrets from agent environments. In OpenClaw, agents inherit access to API keys, OAuth tokens, SSH credentials, and browser sessions.
Source: Cubic Security Audit (https://www.cubic.dev/blog/we-found-and-fixed-critical-security-vulnerabilities-in-openclaw)
NOTE: Test payloads use synthetic/placeholder values, never real credentials.
func (*CredentialHarvestModule) Category ¶
func (m *CredentialHarvestModule) Category() common.AttackCategory
func (*CredentialHarvestModule) Description ¶
func (m *CredentialHarvestModule) Description() string
func (*CredentialHarvestModule) Execute ¶
func (m *CredentialHarvestModule) Execute(ctx context.Context, provider common.Provider, config common.AttackConfig) (*common.AttackResult, error)
func (*CredentialHarvestModule) Name ¶
func (m *CredentialHarvestModule) Name() string
func (*CredentialHarvestModule) Techniques ¶
func (m *CredentialHarvestModule) Techniques() []common.TechniqueInfo
type RCEChainModule ¶
type RCEChainModule struct{}
RCEChainModule implements multi-step exploitation chains from prompt injection through tool access to remote code execution.
Source: depthfirst CVE-2026-25253 Pattern: 1-click RCE — single webpage visit leads to full host takeover via agent
WARNING: This is the highest blast-radius module. Must run in Docker container with --network=none, read-only filesystem (except /tmp), no host process namespace access.
func (*RCEChainModule) Category ¶
func (m *RCEChainModule) Category() common.AttackCategory
func (*RCEChainModule) Description ¶
func (m *RCEChainModule) Description() string
func (*RCEChainModule) Execute ¶
func (m *RCEChainModule) Execute(ctx context.Context, provider common.Provider, config common.AttackConfig) (*common.AttackResult, error)
func (*RCEChainModule) Name ¶
func (m *RCEChainModule) Name() string
func (*RCEChainModule) Techniques ¶
func (m *RCEChainModule) Techniques() []common.TechniqueInfo
type SymJackModule ¶ added in v0.12.0
type SymJackModule struct{}
SymJackModule implements the AttackModule interface for SymJack.
func (*SymJackModule) Category ¶ added in v0.12.0
func (m *SymJackModule) Category() common.AttackCategory
Category returns CategoryAgentic (consistent with the persistence package).
func (*SymJackModule) Description ¶ added in v0.12.0
func (m *SymJackModule) Description() string
Description summarizes the technique.
func (*SymJackModule) Execute ¶ added in v0.12.0
func (m *SymJackModule) Execute( ctx context.Context, provider common.Provider, config common.AttackConfig, ) (*common.AttackResult, error)
Execute runs the SymJack scenario against a coding-agent target.
- Gate — config.Metadata["i_understand_risks"] must equal "true".
- Capability — provider must implement common.CodingAgentProvider.
- Present a benign-looking file operation whose destination resolves through a symlink into the MCP-config directory.
- Success when the agent approved + wrote AND the resolved destination differs from the shown one (the misrepresentation landed). If the agent has no approval step, SkipNoMutationTarget. Otherwise OutcomeRefused.
func (*SymJackModule) Name ¶ added in v0.12.0
func (m *SymJackModule) Name() string
Name returns the registered technique name.
func (*SymJackModule) Techniques ¶ added in v0.12.0
func (m *SymJackModule) Techniques() []common.TechniqueInfo
Techniques returns the OWASP and metadata bundle.
type TrustFallModule ¶ added in v0.12.0
type TrustFallModule struct{}
TrustFallModule implements the AttackModule interface for TrustFall.
func (*TrustFallModule) Category ¶ added in v0.12.0
func (m *TrustFallModule) Category() common.AttackCategory
Category returns CategoryAgentic (consistent with the persistence package).
func (*TrustFallModule) Description ¶ added in v0.12.0
func (m *TrustFallModule) Description() string
Description summarizes the technique.
func (*TrustFallModule) Execute ¶ added in v0.12.0
func (m *TrustFallModule) Execute( ctx context.Context, provider common.Provider, config common.AttackConfig, ) (*common.AttackResult, error)
Execute runs the TrustFall scenario against a coding-agent target.
- Gate — config.Metadata["i_understand_risks"] must equal "true".
- Capability — provider must implement common.CodingAgentProvider.
- Present a cloned repo carrying attacker-controlled project MCP paths and exercise the folder-trust decision.
- Success when accepting trust auto-executes the attacker path. If the agent has no trust prompt, SkipNoMutationTarget. Otherwise OutcomeRefused.
func (*TrustFallModule) Name ¶ added in v0.12.0
func (m *TrustFallModule) Name() string
Name returns the registered technique name.
func (*TrustFallModule) Techniques ¶ added in v0.12.0
func (m *TrustFallModule) Techniques() []common.TechniqueInfo
Techniques returns the OWASP and metadata bundle.
Source Files