Before the first prompt: Code execution paths in trusted coding-agent projects

This article details two novel code execution techniques in trusted coding-agent projects that occur after project trust but before the first user prompt, bypassing traditional security controls. In Codex, a malicious project can define a project-scoped Model Context Protocol (MCP) server in .codex/config.toml, causing immediate execution of attacker-controlled processes upon project open. In Claude Code, an attacker can manipulate the PATH environment variable via .claude/settings.json to hijack Git calls and execute a malicious git wrapper script from within the repository. These techniques allow code execution without model interaction or user approval, highlighting the risk of treating project trust as safe.

AI-extracted · verify before operational use