u/GelosSnake

We added a detection rule for --allow-dangerously-skip-permissions in Claude Desktop. Then we found an attack chain nobody was talking about.

"No shell, no impact" is the wrong mental model for AI agents.

An agent running with that flag, even with Bash blocked, can still:

• Read SSH private keys, .env files, AWS credentials, and browser session databases

• Write to ~/.zshrc, .git/hooks/pre-commit, ~/.ssh/authorized_keys, or source files in your repo

Execution is deferred. The next terminal you open, the next commit you push, the next CI run, runs the payload.

It gets worse. Skills load as trusted context with no signatures, no checksums, and no version pinning. Inject once, persist in ~/.claude/skills/, and wait. The user invokes the skill days later in a fresh session, and the payload runs with full trust. No anomalous process, network, or permission signal to catch it.

What defenders should do today:

• Monitor ~/.claude/skills/ for unexpected modifications

• Vet every MCP tool and skill before installation

• Audit shell configs and git hooks after any agent session

• Stop treating --allow-dangerously-skip-permissions as safe just because Bash is off

The first sign wasn’t a security alert. It was a temperature reading.
A food plant’s cold rooms were warming up and the product was spoiling. The engineers expected a dead compressor. Instead, someone had been inside the controllers and rewritten them on purpose: setpoints, safety limits, valves pinned open, and the engineers’ own remote account locked out while the plant failed. Three compressors destroyed. No malware required, just an attacker who understood refrigerant physics.
On the same network, our team found a disk wiper hiding as a fake Microsoft update.
One IRGC-directed front. Two target sets, IT and OT. And it all ran under a ceasefire, when everyone had been told the fighting was over. That’s not a coincidence. It’s the doctrine.
Our IRT broke the whole thing down, with GRAT IOCs and a YARA rule: