{
 "public_id": "AIR-2026-0252",
 "incident_id": "2026-05-adversa-trustfall-project-mcp-execution",
 "date_disclosed": "2026-05-07",
 "date_occurred": null,
 "title": "TrustFall: project-defined MCP servers execute after a single keypress in Claude Code, Cursor CLI, Gemini CLI and Copilot CLI",
 "class": "responsible_disclosure",
 "attack_surface": "coding_agent",
 "initial_vector": "malicious_repository_project_mcp_config",
 "agent_capability_abused": [
  "project_scoped_mcp_servers",
  "trust_dialog_consent",
  "headless_ci_execution"
 ],
 "target_product": "Claude Code; Cursor CLI; Gemini CLI; GitHub Copilot CLI",
 "target_vendor": "Anthropic; Cursor; Google; GitHub (Microsoft)",
 "autonomy_level": "copilot_with_approval",
 "impact_realized": false,
 "impact_type": [
  "remote_code_execution",
  "data_exfiltration"
 ],
 "blast_radius": "developers who open an untrusted repository in the listed CLIs; headless CI runners in a variant",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI04",
   "ASI05"
  ],
  "mitre_atlas": [],
  "labels": [
   "trust_dialog",
   "project_scoped_config",
   "consent_ux"
  ]
 },
 "defense_present": "folder trust dialog",
 "defense_bypassed": true,
 "fix_shipped": "None for Claude Code: Anthropic declined the report as outside its threat model",
 "primary_sources": [
  "https://adversa.ai/blog/trustfall-coding-agent-security-flaw-rce-claude-cursor-gemini-cli-copilot/"
 ],
 "verified_quote": "declined it as outside their threat model",
 "confidence": "high",
 "notes": "Adversa reports no CVE for TrustFall. CVE-2026-33068 is a separate Claude Code issue (a repository setting that skips the trust dialog, fixed in 2.1.53) that Adversa lists as an earlier, related finding and should not be attached to this record. Anthropic's position, per Adversa, is that accepting the trust prompt is consent to the full project configuration and that post-trust execution is the boundary working as designed; Adversa does not contest where Anthropic drew the line but argues the pattern recurs. Proof of concept opens a calculator; a headless variant exfiltrates environment variables from a CI runner. Demonstrated only.",
 "risk_category": "security_fraud",
 "risk_secondary": [
  "privacy"
 ],
 "risk_subcategory": "Supply Chain Compromise",
 "risk_sub_secondary": [
  "Remote Code Execution & Sandbox Escape"
 ],
 "ai_entity": "generative",
 "agency": "ai_as_target",
 "agency_debatable": true,
 "agency_reason": "the coding CLI launches project-defined MCP servers after one keypress; no model action is in the chain, but the trust dialog gating agent tooling is the failed control",
 "vector_family": "malicious_component",
 "vector_detail": "malicious_repository_project_mcp_config",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI04",
 "agent_framework": "unknown",
 "model_provider": "multiple",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "supply_chain_vulnerabilities",
 "eai_domain": "tool_misuse",
 "eai_secondary": [
  "privilege_escalation",
  "data_exfiltration_channels"
 ],
 "eai_reason": "subcategory: Supply Chain Compromise",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI04 (vector_family=malicious_component); ASI05 (impact=code_exec)",
 "submitted_by": "EAI Internal"
}