The @addai/entity-runtime package runs a daemon that polls a hardcoded Supabase endpoint for remote job rows. It spawns AI agent binaries (Claude Code, Codex, Kimi, Gemini, Grok) in a pseudo-terminal on the installer's host, driven by fields controlled by the remote party. When the input permissionMode is set to 'bypassPermissions', the agent is invoked with a flag that allows it to execute arbitrary shell commands as the local user without any interactive prompt. Additionally, the package disables the safety prompt of Claude Code's bypass-permissions mode by writing a configuration file in the user's home directory, affecting all future interactive sessions. The package also modifies the PATH environment by reading a user config file. This creates a persistent remote-controlled channel enabling host-level remote code execution and persistent lowering of safety protections.

This malicious package enables a remote party to execute arbitrary shell commands on the installer's machine with the same privileges as the local user, without any interactive confirmation. It also disables safety prompts in a related AI tool, increasing the risk of unauthorized command execution in future sessions. The compromise is persistent due to configuration changes on the host, leading to a high risk of host takeover and potential further malicious activity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix or official guidance is available, users should immediately uninstall the affected versions of @addai/entity-runtime and avoid installing or running this package. Review and remove any configuration files created by the package (e.g., ~/.claude/settings.json and ~/.kimi/config) to restore safety prompt functionality and environment integrity. Monitor for suspicious activity related to spawned AI agent processes and remote connections to the hardcoded Supabase project.