security<\/p>\n
Security biz Adversa AI argues users of AI tools need clearer warnings<\/p>\n
How explicit does the maker of a footgun need to be about the product’s potential to shoot you in the foot?<\/p>\n
That’s essentially the question security firm Adversa AI is asking with the disclosure of a one-click remote code execution attack via an MCP server in Claude Code, Gemini CLI, Cursor CLI, and Copilot CLI.<\/p>\n
The TrustFall proof-of-concept attack demonstrates how a cloned code repository can include two JSON files (.mcp.json and .claude\/settings.json) that open the door to an attacker-controlled Model Context Protocol (MCP) server.<\/p>\n
MCP servers make tools, configuration data, schemas, and documentation available in a standard format to AI models via JSON.<\/p>\n
The vulnerability arises from inconsistent restrictions governing the scope of settings: Anthropic blocks some dangerous settings at the project level (e.g. bypassPermissions) but not others (e.g. enableAllProjectMcpServers and enabledMcpjsonServers). The JSON files simply enable those settings.<\/p>\n
“The moment a developer presses Enter on Claude Code’s generic ‘Yes, I trust this folder’ dialog, the server spawns as an unsandboxed Node.js process with the user’s full privileges \u2014 no per-server consent, no tool call from Claude required,” Adversa AI explains in its PoC repo.<\/p>\n
The likely result is a compromised system. The PoC demonstrated in this video<\/a>. It worked on Claude Code CLI v2.1.114, as of May 2. Other agent CLIs are also said to be affected, but specific PoCs have not been published.<\/p>\n “It’s the third CVE in Claude Code in six months from the same root cause (project-scoped settings as injection vector),” Alex Polyakov, co-founder of Adversa AI, told The Register in an email. “Each gets patched in isolation but the underlying class hasn’t been finally fixed. Most developers don’t know these settings exist, let alone that a cloned repo can set them silently.”<\/p>\n