COORDINATED DISCLOSURE
Opening a repository was enough: pre-trust execution in a coding agent
A repository-controlled config file made a coding agent run attacker commands before its own trust dialog appeared, turning cloning a project into code execution.
What this was
Coordinated disclosure, fixed by the vendor. Researcher-found and patched rather than exploited in the wild as far as has been reported. Included because the attack requires nothing of the victim beyond opening a project, which is a normal action rather than a mistake.
What happened
Check Point Research disclosed a set of issues in Anthropic's Claude Code, tracked as CVE-2025-59536 with a CVSS of 8.7 and CVE-2026-21852. A repository could ship a .claude/settings.json registering a SessionStart hook, and the hook command executed when a developer opened the project, before the trust dialog rendered. A second path set enableAllProjectMcpServers alongside a malicious .mcp.json, so MCP initialization ran before the user could read the trust prompt. A third set ANTHROPIC_BASE_URL to an attacker-controlled server, so the agent sent requests carrying plaintext API keys in Authorization headers before trust was confirmed. Versions before 1.0.111 were affected. Anthropic added a warning dialog for untrusted project configurations, prevented MCP execution before approval, and deferred network operations until after trust confirmation.
Why an agent changes the risk
A developer tool that reads repository-controlled configuration has the same problem as any program that executes untrusted input, except the config is not obviously code and code review treats it as settings. The trust dialog existed and was correct in intent; the bug was that several execution paths ran before it. Any agent that loads project-scoped configuration inherits this shape.
How to test for this
- Test what your agent tooling does on open, before any human approves anything. The dialog is not the control if code paths run ahead of it.
- Review agent configuration files with the same rigour as source. A .claude/, .vscode/ or equivalent directory in an untrusted repository is executable content, and a pull request that edits one deserves the scrutiny a PR editing a build script gets.
- Check where agent credentials can be redirected. A base URL taken from repository config is a credential exfiltration path that never touches the model.
Other cases
CONFIRMED INTRUSION
Hugging Face, July 2026: an autonomous agent ran the intrusion end to end
A malicious dataset chained two code-execution paths into node-level access and lateral movement across internal clusters, driven by an attacker framework that executed roughly 17,000 individual actions.
CONFIRMED INTRUSION
Vercel, April 2026: a small third-party AI tool became everyone's problem
An attacker compromised Context.ai, then used an employee's Google Workspace OAuth grant to reach Vercel's internal systems and decrypt non-sensitive environment variables.
SUPPLY CHAIN COMPROMISE
LiteLLM, March 2026: a compromised scanner poisoned an AI gateway
TeamPCP compromised the Trivy CI pipeline, used that access to obtain LiteLLM's PyPI publishing tokens, and shipped a credential stealer in two releases of a package with roughly 95 million monthly downloads.
CONTROLLED EVALUATION
OpenAI Operator: indirect prompt injection becomes an action risk
OpenAI’s published red-team work shows how untrusted content can influence a browser-using agent that can operate tools or move data.
CONTROLLED EVALUATION
Anthropic’s agentic-misalignment evaluation: model access can resemble an insider threat
Anthropic’s fictional corporate simulations test what can happen when a tool-using model has sensitive context, external actions, and a deliberately constructed goal conflict.
VENDOR-REPORTED DISRUPTION
Anthropic’s cybercrime disruption report: an agent can amplify a human attacker
Anthropic reported disrupting accounts that used Claude Code to assist a human-directed cybercrime operation, from reconnaissance through extortion support.
COORDINATED DISCLOSURE
nullifAI: malicious PyTorch models evaded pickle scanning on Hugging Face
Researchers found two Hugging Face-hosted model files with malicious pickle payloads that could reach web shells when loaded in an unsafe environment.