Definition
A trusted component auto-loads configuration from co-located untrusted context (cloned repo, downloaded file, fetched dependency), and that configuration modifies what the AI or operator sees, evading both human and AI review of the modified context.Distinct from
- GER-403 — Config-load inflection point → this code. Component install inflection point → GER-403.
- GER-417 — Trust inherited from co-located untrusted source via config-load → this code. Rule communicated through informal channel without canonical authority binding → GER-417.
- GER-431 — Trusted component auto-loads untrusted config → this code. Vendor pushes update without validation gate → GER-431.
Documented case
CVE-2026-45792 — RTK (Rust Token Killer): unverified filter-config silently alters output shown to the LLM
advisory
Tags
cve-2026-45792 · l2 · supply-chain