title: AI Coding Agent Configuration Tampering
id: f6cb7f1a-864d-482a-bf59-ebe831011fc0
status: experimental
description: Detects writes to configuration and instruction files that steer AI coding agents, including .cursor/mcp.json, .claude/settings.json, AGENTS.md, CLAUDE.md, SKILL.md, and .windsurf/mcp.json. Documented 2026 tradecraft (Google GTIG DUSTMAKER/UNC6780; MITRE ATLAS OpenClaw investigation) plants or modifies these files for persistence, MCP server redirection, and tool poisoning. Modify AI Agent Configuration is MITRE ATLAS technique AML.T0081; malicious MCP config is tracked as proposed technique AML.T0095.
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai
    - https://ctid.mitre.org/blog/2026/02/09/mitre-atlas-openclaw-investigation/
    - https://labs.cloudsecurityalliance.org/agentic/csa-research-note-atlas-agentic-gap-analysis-20260327/
author: Agentic Threat Lab
date: 2026-10-22
tags:
    - attack.persistence
    - attack.t1546
atlas:
    - AML.T0081
    - AML.T0095
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith:
            - '\.cursor\mcp.json'
            - '\.claude\settings.json'
            - '\.windsurf\mcp.json'
            - '\.vscode\mcp.json'
            - '\.continue\config.yaml'
            - '\AGENTS.md'
            - '\CLAUDE.md'
            - '\SKILL.md'
    filter_main_dev_edit:
        Image|endswith:
            - '\code.exe'
            - '\cursor.exe'
            - '\claude.exe'
            - '\windsurf.exe'
    condition: selection and not filter_main_dev_edit
falsepositives:
    - Developers editing their own agent configuration from less common editors (extend the filter for your environment)
    - Repository template files named AGENTS.md being created during legitimate project setup
level: medium