⚠ Risky-Tool Advisory Analyzed codelake triage · 2026-10-20

A security-hygiene observation, not a malware finding. This advisory documents dangerous security practices in a legitimate-purpose tool — for example transmitting credentials over plaintext HTTP, heavy code obfuscation, or automatic global installs. It is not a claim of theft, backdoor or malicious intent: the tool does what it advertises, and the risk falls on its own users and their data. It is published so operators can make an informed decision before installing or deploying it.

Advisory · CLR-2026-3671

A self-updating AI-agent runtime that auto-fetches its executable runtime from a single remote domain whose name evokes Microsoft and Claude

@agent-link/agent (“AgentLink”) is a self-updating AI-agent runtime that connects to wss://msclaude.ai and downloads its own runtime artifacts (release manifests and runtime bundles) from https://msclaude.ai. The downloads are origin-pinned to that one domain and sha256-verified, so there is no third-party dropper and no secret exfiltration — but an auto-updating agent that pulls executable runtime from a single external domain whose name evokes Microsoft (“ms”) and Claude is a supply-chain trust risk for its users. This is not malware.

MediumRisky toolRemote auto-updating runtimeBrand-evocative domainOrigin-pinned + sha256-verifiedNo exfil / not malware

Summary

@agent-link/agent version 0.1.336 (npm, bin agentlink-client) is “AgentLink”, a long-running AI-agent runtime with an elaborate self-upgrade system (download → verify → stage → health-check → rollback). It connects to a backend at wss://msclaude.ai and its session exports are footed “Powered by msclaude.ai”.

codelake independently flagged the 0.1.336 release during supply-chain triage. This version is not in OSV (OSV's malicious records for this package cover earlier 0.1.269–0.1.325 releases). This advisory is about the update/trust model of the current release, not a malicious payload.

Why this is Risky, not Malware

Reading the code statically (no execution): on global install the postinstall prepares an “immutable runtime migration”, and at runtime the launcher/worker fetch release manifests (https://msclaude.ai/files/agent/latest.json, beta.json) and runtime bundles from https://msclaude.ai/files/agent/runtime/. Crucially the artifact origin is pinned (ALLOWED_ARTIFACT_ORIGIN = "https://msclaude.ai") and downloads are sha256-verified before use.

There is no harvesting of .ssh, .aws, .npmrc, .env or browser data, no third-party drop, and no decode-and-execute of an untrusted blob — the child processes spawned are the agent's own launcher during self-upgrade. By mechanism this is a legitimate auto-updater.

The Risky classification reflects the trust posture, not a payload: an agent that silently auto-updates its own executable runtime from a single external domain places complete, ongoing trust in that domain, and the domain name msclaude.ai — evoking Microsoft (“ms”) and Claude — is one a user could mistake for an official Microsoft or Anthropic property. This advisory records an independent detection and does not claim credential theft, a backdoor or a dropper; none were found in this version.

Indicators & characteristics

PKG@agent-link/agent — npm, v0.1.336 (bin: agentlink-client)

HOSTwss://msclaude.ai — agent control/relay backend

HOSThttps://msclaude.ai/files/agent/{latest,beta}.json — self-update release manifests

HOSThttps://msclaude.ai/files/agent/runtime/ — runtime bundle base URL

CODEALLOWED_ARTIFACT_ORIGIN = https://msclaude.ai (download origin pinned); sha256 verification of staged runtime

EXECpostinstall (global) prepares 'immutable runtime migration'; launcher self-spawns during upgrade

NEGno secret harvesting, no third-party drop, no decode-exec of untrusted data

Response & guidance

#	Action	Priority
01	Understand the trust model before installing. This agent auto-updates its executable runtime from `msclaude.ai`; installing it is an ongoing trust decision in that single domain. Do not assume it is a Microsoft or Anthropic property because of the domain name.	Warning
02	Prefer global install only on machines where unattended runtime auto-updates are acceptable, and review the vendor's provenance before granting it long-running agent permissions.	Caution
03	Vendor guidance: publish the runtime provenance and signing keys, and use a domain that does not evoke an unrelated vendor, so users can make an informed trust decision.	Fix

Analyzed independently by codelake Research · AI-assisted triage + deterministic static code review (no execution). Classified Risky tool: a legitimate-purpose agent whose remote self-update trust model is a supply-chain risk for its users — not malware. codelake stores only the detection rule, indicators and analysis, never raw payloads.