Topic · DiggingBeagle record
Agent package lifecycle scripts can persistently rewrite tool and memory authority
Installing a development package can alter global agent memory, tool registration or content telemetry for future sessions without a separate authorization decision.
- Topic kind
- pattern
Definition & limits
Agent configuration is a durable execution input, often broader than the current working directory and persisting after an individual task. A package postinstall or registration script with ordinary filesystem rights may edit settings for multiple coding agents, register persistent MCP servers or enable content-level telemetry. Later sessions consume these changes even if the package was encountered as a one-off dependency. Evidence must separate configuration writes from subsequent activation, network transfer and malicious intent. The reported toga-ai and common-context-mcp behaviors illustrate related but nonidentical mechanisms, while the multi-agent-pipeline token step requires explicit setup rather than postinstall.
The triggering event must be recorded separately from the later side effect. The common-context-mcp and toga-ai reports concern package postinstall actions that change subsequent tool or telemetry settings. The multi-agent-pipeline report instead describes a setup-time code path, so merely downloading that package cannot be counted as credential disclosure. A complete test compares user configuration before and after package execution, starts an independent agent session, captures any outbound data using synthetic secrets and checks whether uninstall restores the original state. Persisted access is established at the configuration write; exfiltration requires separate evidence of actual transfer.
Examples
- [Claude telemetry settings changed on install](db:CASE-2026-TOGA-AI-INSTALL-TELEMETRY).
- [Cross-agent MCP memory registration](db:CASE-2026-COMMONCONTEXT-MCP-INSTALL-REGISTRATION).
- [Setup-time reuse of GitHub credentials](db:CASE-2026-MULTIAGENT-PIPELINE-GH-TOKEN).