TL;DR: Claude Code’s ability to read code, fetch web pages, run commands, and call MCP tools creates a large prompt injection attack surface when permissions are skipped, according to Lasso Security. The real issue is not model capability but the collapse of trust boundaries around untrusted content and trusted execution.
At a glance
What this is: This is an analysis of how Claude Code's automation and MCP access enlarge the indirect prompt injection attack surface when permission checks are removed.
Why it matters: It matters because IAM, PAM, and NHI governance assumptions about trusted context, approval gates, and scoped execution break down when an AI coding agent can act on hostile content.
Context
Claude Code becomes a governance problem the moment untrusted content can influence trusted actions. When a coding agent can read repositories, fetch web pages, call MCP servers, and execute commands, the key question is no longer whether the model is useful but whether the execution boundary is still meaningful.
This article is about indirect prompt injection, where malicious instructions are hidden inside content the agent is expected to process. In identity terms, the problem sits at the intersection of agentic AI, tool access, and permission governance: the system can be made to act on instructions that were never meant to be trusted.
Key questions
Q: What breaks when AI coding tools can turn untrusted content into shell commands?
A: The approval model breaks. If markdown, comments, or embedded instructions can influence execution, then allow-lists and approval prompts no longer validate human intent. The control failure is a trust boundary mismatch between text parsing and command execution, which means a malicious repository or document can trigger actions the user never knowingly authorised.
Q: Why do MCP-based AI systems increase prompt injection risk?
A: MCP-based AI systems increase prompt injection risk because they connect models directly to tools and external context that may contain hidden instructions. Once the model trusts that content, attackers can redirect behavior without breaking authentication. The risk rises when organizations assume access control alone is enough to protect model actions.
Q: How do security teams reduce the impact of prompt injection in code assistants?
A: They should reduce the assistant’s ability to move from reading to executing to sending data. The best pattern is strict tool segmentation, explicit approval for risky transitions, and isolation of secrets from any assistant path that can reach outbound communication or rendering functions.
Q: Should organisations treat AI coding agents like privileged software identities?
A: Yes. If an AI agent can install code, access secrets, or modify repositories, it is functionally acting as a privileged non-human identity and should be governed that way. That means task-scoped access, explicit boundaries, and monitoring of its downstream actions, especially when it can touch build and release systems.
Technical breakdown
How indirect prompt injection rides trusted tool output
Indirect prompt injection works when a model ingests content that looks operationally relevant but contains attacker-controlled instructions. The attack does not need a visible prompt from the user; it can arrive through a repository file, web page, issue comment, API response, or MCP output. The model then processes that content as part of the working context, which means malicious instructions can compete with or override the user's intent. The risk grows when the agent has permission to execute commands or chain tools without interruption, because the unsafe instruction can turn into a real action instead of remaining text.
Practical implication: treat every tool output as untrusted input before it can influence action-taking.
Why MCP servers expand the trust boundary
MCP servers are not the problem by themselves; they are the boundary-expanding mechanism. Once a coding agent can query multiple external systems, each connection becomes a trust boundary carrying its own data quality, authorization, and content integrity risks. A compromised documentation page, note, ticket, or connector response can become a delivery path for embedded instructions. In practice, this is a governance issue as much as a technical one, because the agent is no longer operating inside a single controlled context. It is assembling decisions from multiple sources that were never equally trustworthy.
Practical implication: inventory each MCP connection as a separate trust boundary with its own review and access scope.
Why skipping permission prompts changes the security model
The --dangerously-skip-permissions mode removes the last human checkpoint before action. That shifts the control model from approval-based execution to machine-speed execution, which means suspicious content no longer has to survive a review step before it can trigger shell commands, file writes, or downstream tool calls. This is the crucial difference between automation and uncontrolled autonomy. The article's core warning is not that Claude Code can perform tasks, but that it can be induced to perform tasks from hostile instructions embedded in the material it reads.
Practical implication: scope any approval-free execution so that hostile content cannot directly reach command execution.
Threat narrative
Attacker objective: The attacker wants the coding agent to carry out unwanted actions, exposing data, altering code, or executing commands that the user never intended.
- Entry occurs when an attacker plants malicious instructions inside content the agent is likely to read, such as repository files, web pages, issue text, or MCP responses.
- Credential or privilege abuse follows when the coding agent processes that content with elevated permissions and treats the embedded instructions as legitimate context.
- Impact occurs when the agent executes commands, modifies code, or advances workflows under attacker influence without a human checkpoint.
Breaches seen in the wild
- Anthropic GTG-1002 AI espionage campaign: A state-sponsored group ran Claude Code agents to attack about 30 organisations, harvesting and reusing credentials at machine speed.
- EchoLeak (Microsoft 365 Copilot) 2025: A crafted email could make Microsoft 365 Copilot leak data from its context with no click, a zero-click prompt injection fixed as CVE-2025-32711.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Trust boundaries that separate content from action are the real control here. Claude Code becomes risky when untrusted material can be read in the same working context that authorises execution. That is not a model-quality issue; it is a governance failure around where trust begins and ends. Practitioners should treat content ingestion and command execution as different control zones.
Permission prompts are doing more than user experience work. They are the human brake that prevents hostile instructions from becoming shell access or workflow changes. When the prompt layer is removed, the programme loses a compensating control that was masking weak content trust assumptions. Security teams need to decide which tasks can ever bypass that brake.
Claude Code exposes a runtime trust boundary gap: the system assumes a model can safely process arbitrary text before deciding what to do next. That assumption fails when text itself is the attack vector, because the instruction source and the instruction target are no longer distinguishable at runtime. The implication is that approval-free execution must be analysed as an attack surface, not a productivity feature.
MCP turns identity governance into a multi-boundary problem. Each connector adds another place where content can be edited, injected, or relayed with authority the agent may over-trust. In identity terms, this is similar to overextended delegation chains: the more authorities the agent can absorb, the harder it becomes to reason about intent. Practitioners should redesign governance around source trust, not just destination access.
Machine-speed workflows collapse the time available for review. If a coding agent can read, decide, and act inside one session, then traditional review-after-execution controls are too late. The better framing is not whether the model is autonomous in the abstract, but whether the workflow lets hostile content travel from ingestion to impact without interruption. Security teams should re-evaluate any design that lets that happen.
From our research library:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
- Read next: Red Teaming AI Agents for Identity Abuse
What this signals
Hidden instruction risk is now a runtime governance issue, not a niche prompt trick. Once a coding agent can both read arbitrary content and take action from the same session, the security programme has to govern what enters context before it governs what leaves it. The control point moves upstream to ingestion, connector trust, and execution gating.
Prompt injection is the new identity boundary test for coding agents. If your controls assume content can be safely inspected after the fact, they are already too late for approval-free workflows. The programme question is whether an AI coding agent should ever be allowed to combine untrusted input with privileged actuation in one pass.
For practitioners
- Tighten approval-free execution paths Restrict use of permission-skipping modes to narrowly defined tasks and keep human approval for any command that can write, delete, deploy, or exfiltrate.
- Treat MCP connectors as trust boundaries Review every connected repository, documentation source, ticket system, and database for who can edit content and what the agent can do with it.
- Add runtime prompt injection detection Scan tool outputs before they are inserted into the agent context so that hidden instructions are flagged before they can shape execution.
- Separate read access from actuation Limit the agent's ability to consume external content when the same session can also invoke commands, change files, or trigger downstream tools.
- Audit enterprise managed settings Use centrally enforced settings to prevent individual developers or projects from disabling protective hooks or relaxing execution policy.
Key takeaways
- Indirect prompt injection is dangerous because hidden instructions can flow from ordinary content into privileged execution.
- The article shows that repository files, web pages, issue text, API responses, and MCP outputs can all carry malicious instructions into an agent context.
- Governance should focus on trust boundaries, approval gates, and centrally enforced controls before the agent can act.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | Claude Code can be steered through tools and commands by hidden instructions in content. |
| ASI03 — Identity & Privilege Abuse | The article centres on privileged execution being influenced by hostile context. | |
| ASI07 — Insecure Inter-Agent Communication | MCP and connected systems create trust-boundary problems between sources and the agent. | |
| Recommendation — Restrict tool execution paths so untrusted content cannot drive agent actions. Constrain agent privileges so injected instructions cannot expand runtime authority. Harden inter-system message handling and validate every upstream content source. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The workflow relies on trusted execution without adequate boundary checks on who can influence action. |
| Recommendation — Treat approval-free agent sessions as authentication-sensitive execution paths. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The related AI espionage pattern shows how trusted agents can be used to harvest credentials and move laterally. |
| Recommendation — Map agent-driven credential abuse to TA0006 and TA0008 in detection content. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about overbroad execution authority and missing permission checks. |
| Recommendation — Align agent permissions with PR.AA-05 so untrusted content cannot trigger unauthorised actions. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The discussion of permission-skipping and managed settings maps to controlling credentialed execution paths. |
| Recommendation — Use IA-5 to govern the lifecycle and constraints of credentials used by agentic tools. | ||
Key terms
- Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
- Trust Boundary: A trust boundary is the point where one system’s authority should stop and another system’s authority should begin. For internal automation, weak trust boundaries let monitoring, remediation, and execution share privileges that should have remained separate.
- Managed Settings: A persistent configuration layer that defines what an AI coding tool may do, what it must ask about, and what it cannot touch. For identity teams, this becomes the policy boundary that governs command execution, tool use, and exposure to sensitive paths.
- Approval-Free Execution: A workflow in which a system can act without a human confirmation step between decision and action. For AI coding agents, this narrows the time available to catch hostile content and increases the need for strong upstream content and tool governance.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on June 12, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org