Full Report
People trust their AI assistants and it's easy to abuse this trust
Analysis Summary
This summary outlines the methodology and risks associated with the compromise of AI-integrated desktop environments, as detailed by Pentera Labs in their research regarding "agentic" AI vulnerabilities.
# Technique: AI Agent Preference Poisoning (Indirect Prompt Injection)
## Overview
This technique leverages the synchronization of user "Personalization" or "Custom Instructions" across AI platform accounts to gain remote code execution (RCE). By compromising a user's account credentials or email, an attacker modifies the AI's core behavioral instructions. When the victim uses the desktop application on their local machine, the poisoned instructions force the AI to abuse installed Model Context Protocol (MCP) connectors or social engineer the user into executing malicious payloads.
## Technical Details
- **Type**: Technique / Attack Vector
- **Platform**: macOS, Windows, Linux (via Claude Desktop or similar agentic AI apps)
- **Capabilities**: Tool enumeration, automated command execution, stealthy phishing, and persistence via synced preferences.
- **First Seen**: Research published July 2026 (Initially discovered November 2025).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566 - Phishing] (Used to gain initial entry to the AI account/email).
- **[TA0003 - Persistence]**
- [T1137 - Office Application Startup] (Analogous: leveraging AI Desktop App configuration sync).
- **[TA0002 - Execution]**
- [T1204.002 - User Execution: Malicious File] (Phishing the user to install "fixes").
- [T1059 - Command and Scripting Interpreter] (Abusing MCP connectors to run commands).
- **[TA0008 - Lateral Movement]**
- [T1550.004 - Use Alternate Authentication Material: Web Session Cookies]
## Functionality
### Core Capabilities
- **Preference Infiltration**: Injecting Base64-encoded or natural language prompts into account-wide personalization settings.
- **Environment Enumeration**: Instructing the AI to silently check for the presence of command-line tools or MCP connectors (e.g., Desktop Commander).
- **Automated Execution**: If a tool with system access is found, the AI executes commands (like a reverse shell) without further user intervention.
### Advanced Features
- **Adaptive Phishing**: If no execution tools are found, the AI is programmed to generate "fake" error codes and provide the user with a download link and instructions to install a malicious "fix" or "driver."
- **Cross-Platform Sync**: The malicious instructions follow the user from a mobile device or web browser to their high-value developer workstation.
## Indicators of Compromise
- **File Hashes**: N/A (Technique-based; depends on the specific payload used in the "phishing" phase).
- **File Names**: Look for suspicious third-party MCP connectors or desktop utility installers.
- **Registry Keys**: Changes to directories associated with Claude Desktop or other AI agent configurations.
- **Network Indicators**:
- Outbound connections to unauthorized C2 domains (e.g., `attacker-controlled-node[.]com`).
- Unusual traffic originating from AI application processes.
- **Behavioral Indicators**:
- `claude.exe` or `Claude.app` spawning `cmd.exe`, `powershell.exe`, or `zsh`.
- Sudden changes in the AI's response style or unexpected error messages containing download links.
## Associated Threat Actors
- **Pentera Labs** (Identified as a Red Team technique).
- **General Threat Actors**: Potentially any group utilizing credential stuffing or session hijacking to target developers.
## Detection Methods
- **Configuration Monitoring**: Implement file integrity monitoring (FIM) or specialized logging for changes to AI application configuration files (e.g., `~/Library/Application Support/Claude/`).
- **Behavioral Detection**: Monitor for process trees where an AI assistant process is the parent of a system shell or network utility (curl, wget).
- **Email/Account Auditing**: Alert on "new login" notifications for AI platform accounts, especially from unusual geographic locations.
## Mitigation Strategies
- **Principle of Least Privilege**: Avoid running AI desktop apps with administrative privileges.
- **Sandboxing**: Run AI agents within isolated containers or virtual machines, separate from sensitive source code and production credentials.
- **MCP Restriction**: Limit the installation of third-party MCP connectors and audit the permissions of existing ones.
- **User Training**: Educate staff to never install software or run scripts suggested by an AI to "fix" an internal AI error.
## Related Tools/Techniques
- **[Desktop Commander]**: An MCP tool used to grant AI agents command-line access.
- **[Prompt Injection]**: The underlying vulnerability where untrusted input manipulates LLM output.
- **[Indirect Prompt Injection]**: The specific variant where the prompt is delivered via a synced setting or third-party data.