CERT-EU shows an agent plugin backdoor that steals credentials without a model tool call

Europe's cybersecurity agency CERT-EU has published a controlled-lab demonstration showing that a malicious plugin for AI coding agents can harvest developer credentials and system information without ever producing a model tool call. TechNadu reported on the experiment on November 2, framing it as evidence that a restricted agent and the software running around it can hold very different levels of access.

The researchers worked with local copies of packages associated with Pi 1.3.0 and Claude Code 2.1.304 to avoid touching real users. The component was an extension that adds capabilities to an agent and can execute its own code; according to the report, one of the packages had roughly 1.6 million downloads in a single month.

The trigger is the quietly unsettling part. CERT-EU observed that the malicious code stayed dormant until it encountered the phrase “lgtm, ship it” — ordinary developer shorthand rather than anything resembling a command to steal data. In the test it appeared in user-submitted text, but similar content could arrive in a pasted log or an email, and depending on how an agent handles tool output, the trigger could surface in material nobody typed.

Once active, the so-far unnamed plugin could reach whatever the agent's process could reach. CERT-EU's collector received host and virtual-machine details, user-account information, network configuration, environment variables and credential-related files. The exposure scales with the plugin's permissions, opening the door not only to data theft but to unauthorized code changes and command execution.

What makes the demonstration notable is how it sidesteps standard defenses. The agents kept their conversations going and never displayed a malicious tool call for accessing or transmitting the data; restrictions on the agent's file-reading tools did not stop the extension from reading files; and measures designed to inspect and block model-generated tool calls did not intercept the operation, because the extension acted on its own without involving the model.

CERT-EU's guidance is to treat the whole agent environment as the security boundary: run agents in virtual machines, containers or restricted accounts, cut back on exposed credentials and sensitive files, prefer short-lived narrowly scoped secrets, limit the servers agents can reach, and inventory installed extensions while checking for changes before applying updates.

Monitoring should extend beyond model tool calls to extension execution, sensitive file access, unusual network connections and unauthorized source-code changes. For teams wiring coding agents into daily development work, the takeaway is less about what the model says and more about what the software travelling with it does.