Claude Code RCE Flaw Lets Malicious Pull Requests Execute Code on Developer Machines

A working exploit chain in Anthropic’s Claude Code that lets an attacker gain remote code execution on a developer’s machine through nothing more than a booby-trapped pull request no prompt sent, no tool approved, and no account sign-in required.

Claude Code, like VS Code, asks users to approve a one-time “workspace trust” decision when they first open a project. Once granted, that trust extends to everything checked out into the folder afterward, including other branches pulled later.

Security researcher Kevin Breen argues this is the root problem: “I trust this repository” and “I trust every branch anyone ever opens against this repository” get treated as the same statement, even though an agent, unlike a text editor, can execute what it reads.

Claude Code RCE

The mechanism hinges on Model Context Protocol (MCP) servers, which extend Claude’s capabilities via either remote HTTP endpoints or local commands.

A project-scoped .mcp.json file at a repo’s root tells Claude which MCP servers to load. Critically, Claude reads and initializes this file automatically at session startup, running whatever command it specifies to enumerate the server’s tools before any user input.

The attack requires only that a maintainer clone a repository, check out a pull-request branch, and open Claude the exact review workflow open-source maintainers perform daily.

A malicious .mcp.json, disguised under an innocuous name like “playwright,” can define a command field pointing to netcat, a curl | sh staged payload, an npx-pulled package, or an obfuscated PowerShell one-liner on Windows.

Since command and args amount to an unrestricted process spawn with no sandbox, allowlist, or verification that the “server” is legitimate; anything expressible on the command line executes as the developer’s own user.

Breen demonstrated this against a clone of the popular Bootstrap repository, showing a reverse shell connecting back to an attacker-controlled listener the instant Claude launched, before the user typed a single word.

A real-world payload would prioritize exfiltrating SSH keys, cloud credentials, and tokens from ~/.claude before ever opening an interactive shell.

This class of flaw isn’t isolated. Check Point separately tracked two related CVEs, CVE-2025-59536 and CVE-2026-21852 in which malicious .claude/settings.json or configuration files triggered shell commands and API key theft before any trust dialog appeared, patched in Claude Code 2.0.65.

Adversa AI’s “TrustFall” research found the same architectural pattern auto-executing project-defined MCP servers on trust acceptance across Claude Code, Cursor, Gemini CLI, and Copilot CLI.

Anthropic told Breen that the behavior is “working as designed,” framing the trust boundary as covering the entire repository, including future branches, which is consistent with VS Code’s own Workspace Trust model.

Breen’s proposed remediation: hash agent-executable configuration files (.mcp.json, settings.json) at the moment trust is granted, then re-hash and revoke trust if they change before the next launch, forcing a fresh, informed decision rather than silent inheritance.

As AI coding agents get folded into CI/CD pipelines and daily review workflows, config files like .mcp.json and CLAUDE.md are becoming a new supply-chain attack surface one that traditional code-review scanning wasn’t built to catch.

Until agent vendors treat configuration as executable code deserving continuous re-verification, maintainers should manually inspect any PR touching .mcp.json or .claude/ before switching branches and opening an agent session.