Agent configuration files load into the execution environment before an AI agent begins processing user prompts. That sequence creates a pre-context attack vector that bypasses prompt-level defenses entirely — the malicious instructions are already active when the agent initializes. By poisoning files like .claude/settings.json or .cursor/rules/setup.mdc, an attacker ensures every subsequent session inherits altered behavior without requiring repeated jailbreaking. The agent’s own initialization process becomes the breach.
The Miasma worm campaign, first observed in June 2026, is the concrete proof point. A compromised contributor account pushed a malicious commit to the Azure/durabletask repository, planting five files that targeted four distinct AI coding agents. The commit — 5f456b8, backdated to 2020 with a [skip ci] flag to suppress CI detection — added .claude/settings.json as a Claude Code SessionStart hook, .gemini/settings.json for the Gemini CLI, .cursor/rules/setup.mdc as a Cursor AI prompt injection with alwaysApply set to true, and .vscode/tasks.json configured to run on folder open. All four pointed to a single 4.6MB credential-harvesting payload in .github/setup.js. The payload executed the moment a developer opened the repository — not when they ran code. GitHub disabled 73 repositories across four Microsoft organizations in a 105-second automated sweep. The campaign has since infected over 113 repositories across dozens of accounts.
Standard prompt-injection defenses cannot reach this layer. Prompt injection manipulates what an agent sees within the active context window. Config-file trust exploitation targets the environment configuration that precedes the context entirely. The Check Point Research AI Security Report 2026 documents attackers already poisoning CLAUDE.md files with pen-testing instructions — when the model initially refused, the operator inserted instructions into the trusted file, and every subsequent session automatically inherited the altered behavior. Standard guardrails designed to filter user-provided prompts have no visibility into instructions embedded in the agent’s startup configuration.
The structural root cause is the von Neumann problem applied to agent context. Large language models maintain no formal distinction between data — the configuration contents — and instructions — the prompts. Both are token sequences. Because these files load automatically on session start, they establish a persistent compromise that runtime monitoring struggles to detect. CVE-2026-25725 (CVSS 7.7) confirms this pattern in Claude Code: config-file poisoning establishes persistence and enables cross-agent propagation when multiple agents share a working directory. A single compromised repository can infect every agent a developer uses.
The Miasma worm’s shift from package-install hooks to folder-open hooks marks a significant evolution in supply chain technique. Defenses have historically focused on preinstall and postinstall scripts in package managers. The June 5 attack skips the package manager entirely and targets the developer’s editor. A .claude/settings.json SessionStart hook functions as a postinstall for the editor itself. The same compromised account was used in a May 19 PyPI attack on Microsoft’s durabletask package — the attacker refined the approach from registry poisoning to direct repository injection in seventeen days.
Config-file trust exploitation occupies a different position in the attack timeline than prior T/I/S coverage. MemGhost poisoned agent memory through email. Agentjacking exploited MCP tool trust. ADI demonstrated agent-to-agent trust failures. The Cursor Silent Zero-Day exposed an IDE supply chain flaw. The HF breach revealed guardrail asymmetry between attackers and defenders. Config-file trust exploitation precedes all of these — it compromises the agent’s initialization before any of those layers are even engaged. CVE-2025-54136, the Cursor MCPoison vulnerability, illustrates the same approve-once-trust-forever pattern: attackers commit a benign MCP configuration, wait for approval, then swap in a malicious payload.
Practical defense starts with treating agent configuration files as high-risk code assets, not benign settings. Organizations need mandatory code review and integrity checks for any change to .claude/, .cursor/, .gemini/, and .github/ directories. Pin and integrity-check MCP configurations. Disable auto-approval for agent actions or require per-command consent. Monitor for unexpected edits to configuration directories as a first-line detection signal. The Check Point report recorded a fivefold increase in indirect prompt-injection payloads between March and May 2026, with high-risk enterprise prompts doubling from 2 percent to 4 percent. Business Services showed a 5.91 percent data-exposure rate — one in seventeen AI interactions carrying significant risk. The pre-context environment is now part of the enterprise attack surface whether organizations acknowledge it or not.