There was a supply chain attack last year where a commonly-used VS Code plugin updated and in the background essentially figured out which agents you had available, and then prompted them to exfiltrate any credentials it could find. Not even prompt injection.

Even ore likely, someone boosts search results on a dependency name that looks legit and the agent installs the dependency.

So while any kind of supply chain update could install malware without credentials, I think it's pretty unfortunate that the malware could then use the agent to more powerfully work against you