Free lab · no signup · about 8 minutes
Poisoned Instruction File Lab
An AI coding agent trusts the files around it. One merged pull request, one plugin update or one copied template can put an instruction in front of it that no human reviewer saw.
Review up to eight files: project and user CLAUDE.md, .mcp.json, user settings, a hook script, an auto memory file and a plugin skill. Mark the malicious lines, name the technique, and choose your first move. Fixing the file before you preserve it loses the evidence.
Loading the files…
Synthetic training data: every file, repo, person and host is invented and defanged. Domains are .example, IP addresses are RFC 5737, and invisible characters are simulated.
Where the agent's instructions live
Per the Invictus report and Anthropic's .claude directory documentation, Claude Code keeps session transcripts, tool results, prompt history and file snapshots on the endpoint, and reads configuration from managed, user and project settings, .mcp.json, ~/.claude.json, hooks, plugins and instruction files such as CLAUDE.md. Each of these can carry an instruction someone planted.
| Technique | What to look for | Evidence it leaves |
|---|---|---|
| Hidden comment | HTML comments addressed to "AI agents", with a secret file and an outside URL | Repo history, transcripts showing the file read |
| Lookalike MCP server | One-letter-off hosts; tokens sent in headers | Tool calls named mcp__<server>__<tool> in transcripts |
| Exfiltrating hook | A benign comment, then a network call carrying the transcript | Egress and proxy logs, EDR process records |
| Weakened settings | bypassPermissions, sandbox off, cleanupPeriodDays cut | OTel permission_mode_changed, file timestamps |
| Planted memory | Approvals nobody gave | The session that wrote it |
| Invisible or encoded text | File size far above the visible text; "decode and follow" | The raw bytes: preserve the file, not a copy-paste |
Why evidence comes before the fix
The report's advice is to acquire early, because local files can be deleted or removed by automatic cleanup. cleanupPeriodDays defaults to 30 days and covers transcripts and several other paths, while history.jsonl, auto memory and Desktop or Cowork transcripts follow different rules. If the organisation uses an Enterprise login with the Compliance API enabled, Anthropic also captures Claude Code session transcripts, though authentication and hosting arrangements (ZDR or HIPAA, for example) can exclude sessions. Collect the endpoint copy anyway: it is the version the agent actually read.
Questions
Can a CLAUDE.md or .mcp.json file be used to attack an AI coding agent?
Yes. Coding agents read instruction, configuration and memory files as trusted context, so a line added to one of them can steer the agent. Invictus Incident Response's Frontier Forensics report warns that Claude Code configuration and memory files "also contain instructions that may have been injected to influence an agent". Common tricks are HTML comments that do not render on GitHub, MCP servers on lookalike hosts, hooks that post data out, false approvals in memory, and text hidden with zero-width characters or base64.
What should you do first when you find a poisoned instruction file?
Preserve evidence before you fix anything. Collect the user's ~/.claude directory, ~/.claude.json and the project configuration and instruction files from the live endpoint or a forensic image, and hash them. The report notes that cleanupPeriodDays defaults to 30 days and applies to transcripts and several other paths, so local evidence can be deleted automatically. Then remove the injection, rotate exposed secrets and look for what the agent did.
Which files does Claude Code read that could be poisoned?
The report lists managed, user and project settings, .mcp.json, ~/.claude.json, hooks, plugins and instruction files such as CLAUDE.md, alongside session transcripts, tool results, prompt history and file snapshots stored locally. Memory files and skills are read back into later sessions, which makes a planted line persistent.
Are the files in the lab real attacks?
No. Every file is synthetic and defanged: domains are .example, IP addresses are RFC 5737 documentation ranges, nothing here works as a payload, and invisible characters are simulated rather than embedded. Settings key names other than cleanupPeriodDays, bypassPermissions and dangerouslyDisableSandbox are illustrative.
Keep going
- Agent Defence-Evasion Hunt: find the intruder who turned the controls off in an audit feed.
- Evidence Expiry Race: collect evidence before retention windows close.
- AI Investigation Scoping Lab: pick the starting point and evidence for a Claude incident.
- AI Evidence Readiness: what would you actually have on the day?
- Agent Prompt Injection Harness Lab: how injected text steers an agent harness.
- Agent Plugin Supply-Chain Lab: vet, pin and review plugins and extensions.
- Agent Memory Governance Lab: control what an agent remembers.
- Investigating Claude misuse: evidence sources and retention.
Further reading: Invictus Incident Response, “Frontier Forensics: Anthropic” (Oct 2026, TLP:CLEAR), the source for the file list, cleanup defaults and acquisition advice used here. PlayCISO is not affiliated with Anthropic or Invictus.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.