Claude Code Hooks Run Repo-Supplied Shell on Clone

Context: From Hidden Agent to Visible Threat Surface

Monday's briefing covered the KAIROS hidden agent discovered in Claude Code's leaked source. That was about an undisclosed capability. Today's intelligence is about the documented, intentional features that create equally dangerous attack surfaces — and they're already in your repos.

Claude Code has evolved from a coding assistant into a full execution platform with 12 deep integration features. Three of them warrant immediate security attention.

Three High-Risk Feature Classes

1. Hooks: Shell Execution via Event Triggers

Claude Code fires arbitrary shell scripts on PreToolUse and PostToolUse events. These Hooks execute with the developer's full permissions on their workstation or CI/CD runner. A malicious contributor who adds a Hook to a repo's .claude/ directory gets code execution on every developer who opens the project with Claude Code — no interaction required beyond opening the repo.

A poisoned .claude/ directory is the new poisoned Makefile — except your security team isn't reviewing it yet, and your SAST tools don't flag it.

2. MCP: Direct Database and API Connectivity

Model Context Protocol integrations connect Claude Code sessions to production databases, internal APIs, and external services. Data flows through the LLM context window and potentially to Anthropic's API. This is a data exfiltration path that bypasses DLP controls entirely — your DLP is watching network egress and endpoint file transfers, not LLM context windows.

3. Subagent Spawning: Unmonitored Parallel Execution

Claude Code spawns parallel sub-agent instances for multi-step workflows. Each inherits the parent's permissions. Your EDR sees one Claude Code process; underneath, multiple autonomous agents are executing with inherited credentials and no individual monitoring.

The Repo Poisoning Vector in Detail

The critical new attack vector: .claude/ directories and CLAUDE.md files committed to source repositories. These config files load automatically at session start and can contain:

• Hooks — shell scripts executed on specific Claude Code events
• Skills — persistent commands that modify agent behavior
• MCP configurations — pre-configured database and API connections
• Rules — behavioral modifications that alter how Claude processes code

This is functionally identical to the .vscode/settings.json attack vector — but less understood by security teams and not yet included in standard code review checklists. Your PR reviewers know to scrutinize Dockerfile changes and CI pipeline modifications. They do not yet know to scrutinize .claude/ changes.

Connecting to the Agent Autonomy Problem

An emerging 5-level AI agent taxonomy puts this in broader context. Claude Code operates at Level 3 (delegated execution with developer permissions). But tools like Sim Studio's Mothership — open-source, self-hostable, 27,000+ GitHub stars — operate at Level 5: agents that create other autonomous agents. A compromised Level 5 system doesn't just execute malicious actions. It creates autonomous agents that execute malicious actions independently, on their own schedules, with inherited production credentials.

Your incident response playbook has no procedure for 'rogue agent spawned rogue agents operating on their own cron schedule with production credentials.'

The recursive trust problem is qualitatively different from any current threat category. It needs to be modeled explicitly.