It may start with a developer clicking Approve.
That is the ugly little truth sitting under the current wave of AI assisted development. We spent decades teaching people not to click suspicious links. Then we gave them coding agents, browser extensions, workflow imports, package managers, and MCP servers that ask for approval in clean little boxes that look like safety controls.
That prompt feels like consent. It feels like governance. It feels like the machine is asking permission before it does something dangerous.
That feeling is bullshit.
An approval prompt is not a security boundary. It is a trust transaction. If the user cannot see what is really being approved, then the prompt is not protecting the human. It is laundering risk through the human.
GlassWorm proved developers are the new high value entry point. CrowdStrike said its May 26, 2026 takedown disrupted a global botnet targeting software developers through the open source supply chain, with Google and the Shadowserver Foundation involved in the coordinated operation. The campaign used multiple command and control channels, including Solana blockchain, BitTorrent DHT, Google Calendar, and traditional VPS infrastructure. [1]
That is not random criminal noise. That is adversaries understanding where power moved.
The power moved into the developer workstation.
The power moved into the build pipeline.
The power moved into the agent that can read your repo, touch your files, call your tools, write your code, and ask you to approve the next step.
GlassWorm was already abusing developer trust before the takedown. Koi Security documented GlassWorm in October 2025 as a self propagating worm targeting OpenVSX extensions, using invisible Unicode variation selectors to hide malicious code and harvesting developer credentials, GitHub tokens, npm credentials, and wallet data. [2] Socket later reported that since January 31, 2026 it had identified at least 72 additional malicious Open VSX extensions linked to GlassWorm, including extensions mimicking tools for AI powered coding assistants. [3]
Read that again.
Extensions for AI coding workflows were part of the target set.
This is not a normal supply chain story with a new coat of paint. This is supply chain compromise moving into the decision layer.
SymJack made that painfully clear. Adversa AI described a class of attack where a booby trapped repository can abuse symlinks so the developer approves what appears to be a harmless file copy while the operating system writes somewhere else. The researchers said they tested the pattern against Claude Code, Gemini CLI, Antigravity CLI, Cursor, Copilot, Codex, and Grok Build. [4]
That matters because the approval prompt showed one thing while the system did another.
That is the core problem.
Security teams are still talking like the user is approving an action. In these workflows, the user may only be approving a story about an action.
The agent says it will copy a file.
The file system follows a symlink.
The configuration changes.
The MCP server gets installed.
The agent gets more reach.
The human approved the lie.
MCP makes the problem sharper. MCP is powerful because it gives agents a way to connect with tools, data, services, and local workflows. That same power creates a brutal security question. What happens when a trusted agent connects to an untrusted tool and the approval flow hides the real effect?
Flowise gave us a clean example of how dangerous this layer can become. GitHub’s advisory for GHSA 3gcm f6qx ff7p says Flowise version 3.0.5 had a remote code execution vulnerability in the CustomMCP node because it parsed user supplied MCP server configuration in a way that executed JavaScript code without security validation. The patched version is 3.0.6. [5] OSV describes the same root cause: user supplied mcpServerConfig was parsed while JavaScript code was executed without security validation. [6]
That is not theoretical. That is the automation layer becoming code execution.
This is where people need to stop romanticizing agents as productivity magic.
Agents are not interns.
Agents are not assistants.
Agents are execution engines wrapped in a conversation.
When they touch code, secrets, browsers, package managers, CI systems, cloud consoles, and local files, they become part of the attack surface. When they ask for approval, the approval itself becomes an attack surface.
The Packagist incident points in the same direction. The Hacker News reported on May 23, 2026 that a coordinated supply chain attack impacted eight Packagist packages and included malicious code designed to retrieve and run a Linux binary from a GitHub Releases URL. [7] Packagist then published an update describing supply chain security improvements, including minimum release age policy support in Composer, better admin tooling, package freezing during active account compromise, MFA event visibility in transparency logs, MFA status on maintainer profiles, and organizational package ownership. [8]
That response is important because it shows where the industry is going.
Delay risky changes.
Make trust visible.
Kill shared ownership models.
Expose authentication state.
Freeze compromised packages.
That same thinking has to be applied to AI agents.
Agent approvals need minimum friction for dangerous actions. They need visible provenance. They need scoped permissions. They need policy enforcement. They need logs that humans can actually understand after the fire starts.
Right now, too many teams are treating agent prompts like a speed bump. Attackers are treating them like a door handle.
Claude Code themed ClickFix attacks showed how easily developer trust can be steered before the agent even runs. SC Media reported on May 29, 2026 that an attack impersonating the Claude Code installation process used SEO poisoning and ClickFix social engineering to execute a .NET based infostealer. [9] Push Security had already documented InstallFix, where attackers used cloned developer tool sites and malicious search ads to push fake install instructions for tools including Claude Code. [10]
That is the same pattern in a different skin.
Make the page look trusted.
Make the command look normal.
Make the prompt look helpful.
Make the victim participate.
Browser extensions are part of this mess too. LLMReaper is a proof of concept Chrome extension showing passive DOM based exfiltration of AI conversations from services like ChatGPT and Claude. The author states that the proof of concept demonstrates how a malicious extension can look legitimate while fetching conversations in real time without obvious indication. [11]
That should make every company using AI for sensitive work uncomfortable.
Your model controls are not enough if the browser can read the conversation.
Your DLP story is not enough if the extension layer is ignored.
Your AI governance policy is not enough if the human approving the prompt cannot see what the prompt really does.
This is the part nobody wants to say out loud.
We are building autonomous workflows on top of user interfaces that were designed for manual trust.
That does not scale.
A human can review a command.
A human can review a diff.
A human cannot reliably reason about every indirect effect of an agent action that touches symbolic links, package lifecycle scripts, MCP tool definitions, extension permissions, imported workflows, hidden dependencies, OAuth tokens, local files, cloud credentials, and CI secrets.
That is not a training problem.
That is an architecture problem.
The answer is not to tell developers to be more careful. That is lazy security theater. Developers are already drowning in alerts, pull requests, tickets, deadlines, broken builds, compliance rituals, and management fantasy math. Now we are asking them to babysit semi autonomous systems that can mutate the environment faster than a human can inspect it.
So here is the no bullshit version.
Do not trust approval prompts by default.
Treat AI agent approvals as privileged operations.
Block agents from writing outside the workspace unless policy explicitly allows it.
Disable automatic MCP server installation unless it is brokered, pinned, reviewed, and logged.
Treat imported workflows like code.
Treat browser extensions as data access tools, not convenience toys.
Require human readable diff views before file changes.
Require machine enforceable policy before execution.
Log every agent action in a way incident responders can reconstruct.
Separate agent identity from human identity.
Do not let an agent inherit the keys to the kingdom just because the developer is authenticated.
The old perimeter was the network.
Then identity became the perimeter.
Then the pipeline became the perimeter.
Now the decision layer is becoming the perimeter.
That means the new question is not just, “Who clicked approve?”
The real question is, “What did the system make them think they approved?”
That is where the next breach is going to live.
Not in the button.
In the gap between the button and reality.
About the Author
Len Noe is a Solutions Architect at BeyondTrust, Transhuman, Podcaster, International Cyber Security Speaker, Author, Technical Evangelist, and Biohacker with 11 implanted microchips. A former blackhat and ex-1% motorcycle club member with more than 30 years in technology, he has presented in over 70 countries and is featured in the documentary I Am Machine, which premiered at DEF CON 2025.
https://www.i-am-machine.com
References
[1] CrowdStrike. “Inside CrowdStrike’s Takedown of a Developer Targeting Botnet.”
https://www.crowdstrike.com/en-us/blog/inside-crowdstrike-takedown-of-a-developer-targeting-botnet/
[2] Koi Security. “GlassWorm: First Self Propagating Worm Using Invisible Code Hits OpenVSX Marketplace.”
https://www.koi.ai/blog/glassworm-first-self-propagating-worm-using-invisible-code-hits-openvsx-marketplace
[3] Socket. “72 Malicious Open VSX Extensions Linked to GlassWorm Campaign Now Using Transitive Dependencies.”
https://socket.dev/blog/open-vsx-transitive-glassworm-campaign
[4] Adversa AI. “The Approval Prompt Is Lying to You: Symlink RCE in Five AI Coding Agents.”
https://adversa.ai/blog/the-approval-prompt-is-lying-to-you-symlink-rce-in-five-ai-coding-agents-claude-code-cursor-antigravity-copilot-grok-build/
[5] GitHub Advisory Database. “Flowise Has Remote Code Execution Vulnerability.”
https://github.com/advisories/GHSA-3gcm-f6qx-ff7p
[6] OSV. “GHSA 3gcm f6qx ff7p.”
https://osv.dev/vulnerability/GHSA-3gcm-f6qx-ff7p
[7] The Hacker News. “Packagist Supply Chain Attack Infects 8 Packages Using GitHub Hosted Linux Malware.”
https://thehackernews.com/2026/05/packagist-supply-chain-attack-infects-8.html
[8] Packagist. “An Update on Composer and Packagist Supply Chain Security.”
https://blog.packagist.com/an-update-on-composer-packagist-supply-chain-security/
[9] SC Media. “‘Claude Code Install’ Search Result Leads to ClickFix Infostealer Attack.”
https://www.scworld.com/news/claude-code-install-search-result-leads-to-clickfix-infostealer-attack
[10] Push Security. “InstallFix: Weaponizing Malvertised Install Guides.”
https://pushsecurity.com/blog/installfix
[11] The White H4t. “LLMReaper: DOM Based AI Conversation Exfiltration via Browser Extensions.”
https://thewhiteh4t.github.io/blog/ai-chat-llmreaper/