AI Coding Agent Hooks: The Security Risks Finance Teams Must Know

Hooks Are a New, Useful, and Genuinely Risky Feature

Since mid-2025, every major AI coding agent has shipped some form of "hooks" — shell commands the agent runs automatically at defined lifecycle events, rather than only when a human types a prompt. Claude Code shipped the original surface: PreToolUse, PostToolUse, UserPromptSubmit, Stop. Cursor 1.7 followed with beforeShellExecution, beforeMCPExecution, beforeReadFile, and afterFileEdit. Windsurf added "Cascade Hooks." GitHub Copilot CLI added its own lifecycle-point hooks. The legitimate use is real: auto-lint after every edit, block a commit that contains a secret, enforce an internal policy on every tool call the agent makes.

The problem is where the hook configuration lives. In every one of these tools, it can be defined in a file inside the project repository itself — .claude/settings.json, a Cursor hooks config, an MCP server manifest. That turns a hook system from "something I configured for myself" into "something anyone who can get me to open their repository can configure for me."

The CVEs: This Is Not Hypothetical

CVE-2025-59536 (CVSS 8.7, fixed in Claude Code 1.0.111) is the clearest case. A malicious repository's .claude/settings.json could set enableAllProjectMcpServers and enabledMcpServers to auto-approve MCP servers and execute shell commands before the user ever saw the startup trust-dialog prompt. Cloning the repo and opening it in Claude Code was enough — no further action required. Impact: remote code execution and theft of the developer's API tokens.

CVE-2025-53773 (CVSS 7.8) hit GitHub Copilot and Visual Studio through a different door: prompt injection, not a config-file bypass. Malicious instructions hidden in a pull request description, a GitHub issue, or a webpage the agent was asked to summarize could get Copilot to write "chat.tools.autoApprove": true into .vscode/settings.json — flipping the agent into an unsupervised "YOLO mode" that executes shell commands and browses the web without confirmation. Researchers demonstrated this propagating itself: a compromised agent editing new projects it touches to carry the same payload forward, a pattern nicknamed "ZombAI."

A third, unrelated platform — Flowise, a low-code agent-orchestration tool — had a maximum-severity CVE in its CustomMCP configuration field that allowed arbitrary JavaScript injection, giving RCE on the orchestration host. Three different vendors, three different specific bugs, one shared root cause: a configuration file that the agent treats as instructions and the host treats as executable code.

• "Review the .claude/settings.json, .cursor hooks config, and any .mcp.json files in this repository before I open it in an AI coding agent. Flag anything that: auto-approves MCP servers or tool calls, writes to another settings file, runs a network request, or reads environment variables or files outside the project directory. Treat this the same way you'd review an unfamiliar postinstall script before running npm install."

Why Finance Teams Specifically Need to Treat This as Operational Risk

A development workstation or server running an AI coding agent typically has exactly what these attacks go after: API keys, cloud credentials, SSH keys to production infrastructure, and database connection strings in environment variables or local config files. In a financial services context, that workstation's blast radius usually includes production trading, underwriting, or customer-data systems — not just a hobby project. The same OWASP Agentic Skills Top 10 research that documents AST02 (Supply Chain Compromise) also found a skills-marketplace study with over 1,184 malicious skills distributing credential-stealing malware, and a separate scan finding prompt injection in 36% of sampled agent skills — with one technique, "Semantic Compliance Hijacking," disguising malicious instructions as ordinary compliance-rule prose inside a config file, at a 0.00% scanner detection rate in testing.

None of this requires a sophisticated attacker targeting your firm specifically. It requires one developer cloning one unreviewed open-source repository, or opening one project shared by a vendor or contractor, with an AI coding agent that has hooks enabled.

• "Our engineering team uses [Claude Code / Cursor / Copilot CLI] for internal tooling. Draft an internal policy covering: (1) keeping these tools on auto-update so CVE fixes land automatically; (2) a review step before opening any externally-sourced or newly-cloned repository with the agent enabled — what specifically to check in its settings/hooks/MCP config files; (3) where API keys, SSH keys, and cloud credentials should and shouldn't be stored on a workstation that also runs these agents; (4) what to do if a hook or MCP config is found that wasn't authored by our team."

Where to Start

Three concrete, low-effort steps: keep every AI coding agent your team uses on auto-update (CVE-2025-59536's fix shipped in a point release — teams on manual update cycles were exposed longer than necessary); before opening an unfamiliar or freshly-cloned repository with an agent that has hooks or MCP auto-approval enabled, read its settings/hooks/MCP config files the same way you'd read an unfamiliar postinstall script; and get an inventory of exactly where API keys, SSH keys, and production credentials live on any workstation or server that also runs one of these agents, since that is the asset these specific CVEs were built to reach. See our prompt injection in financial AI and secure MCP deployment coverage for the adjacent attack surfaces this connects to.

Frequently Asked Questions

What are AI coding agent hooks?

Hooks are shell commands that an AI coding agent runs automatically at defined lifecycle events — before or after it uses a tool, edits a file, or runs a shell command. Claude Code shipped the original PreToolUse/PostToolUse hook surface; Cursor 1.7 added beforeShellExecution, beforeMCPExecution, beforeReadFile, and afterFileEdit; Windsurf added Cascade Hooks; GitHub Copilot CLI added its own lifecycle hooks. They're configured in a JSON or YAML file that can live inside a project repository, which is exactly what makes them a security-relevant feature rather than a convenience one.

Can a cloned repository's hook configuration actually execute code on my machine?

Yes, and this has already happened in the wild. CVE-2025-59536 (CVSS 8.7, fixed in Claude Code 1.0.111) let a malicious repository's .claude/settings.json auto-approve MCP servers and run shell commands before the user ever saw the trust-dialog prompt — simply cloning and opening the project was enough to trigger remote code execution and API token theft. The broader pattern, tracked by OWASP as Agentic Skills Top 10 item AST02 (Supply Chain Compromise), is that hook and skill configuration files are data to the model but executable code to the host.

Is this limited to Claude Code, or does it affect other AI coding tools too?

It affects the category, not one vendor. CVE-2025-53773 (CVSS 7.8) showed prompt injection hidden in a pull request description, GitHub issue, or webpage could get GitHub Copilot to write chat.tools.autoApprove: true into .vscode/settings.json, flipping the agent into an unsupervised mode that let it run shell commands and browse the web without confirmation — researchers demonstrated this propagating self-replicating behavior across repositories, nicknamed ZombAI. Flowise, a separate low-code agent platform, had a maximum-severity CVE in its CustomMCP configuration field enabling arbitrary JavaScript execution on the orchestration host.

What should a finance team actually do about this?

Keep AI coding agents on auto-update so CVE fixes apply automatically; review a repository's settings/hooks/MCP configuration files before opening it with an agent that has hooks or MCP auto-approval enabled, the same way you'd review an unfamiliar postinstall script; and inventory where API keys, SSH keys, and production credentials sit on any machine that also runs one of these agents, since that's the specific asset these CVEs target.