Ran a coding agent on a repo you didn't write? Check what it left in your shell. On October 15, 2026, CVE-2026-55607 — a Claude Code worktree sandbox escape — was disclosed, and the advisory told users to hand-check ~/.zshenv for planted lines. That is the persistence half of prompt injection: malicious instructions hidden in an untrusted repo get the agent to write a line into a file that runs every time you open a terminal, long after the agent session ends.
The short answer: what is prompt injection at its most dangerous? Not a clever chat message — a durable change to your machine. A planted dotfile line executes with your privileges at every shell startup. The diff tool below compares a “before” and “after” copy of any shell startup file and classifies every added line as PLANTED-SUSPECT, NOTABLE or BENIGN. It runs 100% in your browser — nothing you paste leaves this page.
Prompt injection is an attack where untrusted content — a file, web page or repository — contains instructions that an AI agent follows as if its user had given them. When those instructions make the agent edit a shell startup file, the attack gains persistence: the planted line keeps running at every login, on every new terminal, whether or not the agent is ever used again.
According to the advisory as briefed for this check, CVE-2026-55607 describes a worktree sandbox escape in Claude Code disclosed on October 15, 2026. A worktree sandbox is meant to confine an agent to a checkout of one repository. An escape breaks that confinement, so files outside the repo — including the startup files in your home directory — can be modified. The advisory's own remediation was strikingly manual: open ~/.zshenv and look for lines you did not write. This page turns that hand-check into a repeatable diff.
Honest scope note: this page cannot scan your computer, and it does not try. You bring the two versions of a file; the tool does the comparison and the pattern classification locally, in this tab.
A sample pair is preloaded — the “after” text contains planted lines among ordinary changes, so you can see the classification instantly. Replace both boxes with your own snapshot and current file, then run the diff.
Inspect these 7 locations — 6 startup files plus your crontab:
~/.zshenv — read by every zsh invocation, including scripts; the file the CVE-2026-55607 advisory named first.~/.zprofile and ~/.zshrc — login and interactive zsh startup.~/.bashrc, ~/.bash_profile and ~/.profile — the bash and POSIX equivalents.crontab -l and look for entries you did not schedule.Grep for these suspicious patterns in each file:
curl or wget command piped into sh, bash or zsh.base64 with decode flags, or long opaque encoded strings.eval keyword applied to a variable, or command substitution running downloaded content.alias redefining ls, git, cd or sudo.LD_PRELOAD, DYLD_INSERT_LIBRARIES, BASH_ENV or ZDOTDIR.source or . line pointing inside a repo, a relative path, or /tmp.PATH entry prepended from a repository or temporary folder.Example sweep: grep -nE 'curl|wget|base64|eval|LD_PRELOAD|BASH_ENV|ZDOTDIR|source|\.' ~/.zshenv ~/.zshrc ~/.bashrc — then judge every hit against what you remember writing.
Coding agents run with your user account's file permissions, and shell startup files live in your home directory, outside the repository they were asked to edit. A sandbox is supposed to fence the agent into a worktree, but CVE-2026-55607 showed a worktree escape could break that fence, letting instructions from an untrusted repo reach files the user never opened.
A planted line usually runs code at every shell startup: a download piped straight into a shell, a decoded blob being executed, an alias that quietly shadows a common command like ls or git, a PATH entry pointing inside a repository, or a source line loading a script from a folder you do not control. It hides among your real settings.
Do not just delete it and move on. Save a copy of the file for evidence, remove the line, then assume anything that ran at startup had your privileges: rotate exposed credentials and tokens, review recent shell and account activity, and check your crontab and other startup files too, because one planted line rarely travels alone.
Before the run, copy each startup file into a dated snapshot folder outside any repository, or commit them to a private dotfiles repo so changes show up as a diff. After the run, compare the live files against that snapshot with the tool above. Two minutes of copying turns a forensic question into a yes-or-no answer.
Related checks:
Get early access to the Ingenious AI platforms: DisclosureGuard · ModelMinder · TermsWatch · Vibe-Code Audit · Rogue-Agent Defense · BreachHunter · ChatBreaker · Agent Flight Recorder · Agent Auth Gateway · DomainGuard · ContentCraft AI
Get early access on WhatsApp →
The CVE-2026-55607 framing on this page follows the advisory summary in the original briefing for this check: a Claude Code worktree sandbox escape disclosed October 15, 2026, whose guidance told users to hand-check ~/.zshenv. The sample dotfiles above use a reserved invalid domain and are illustrative, not live payloads. The diff tool is a pattern classifier, not a guarantee: a line marked BENIGN can still be unwanted, and a NOTABLE line may be a change you made yourself. Nothing pasted into this page is transmitted anywhere.