Disclosed vulnerability
TrustFall: project-defined MCP servers execute after a single keypress in Claude Code, Cursor CLI, Gemini CLI and Copilot CLI
AIR-2026-0252 AIR record · 2026-05-adversa-trustfall-project-mcp-execution
From the supporting source
declined it as outside their threat modeladversa.ai
The record
Disclosed
2026-05-07
Vendor
Anthropic; Cursor; Google; GitHub (Microsoft)
Product
Claude Code; Cursor CLI; Gemini CLI; GitHub Copilot CLI
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Privilege escalation, Data exfiltration channels
System type
Generative model
Who acted
AI was the target (contested) — the coding CLI launches project-defined MCP servers after one keypress; no model action is in the chain, but the trust dialog gating agent tooling is the failed control
Attack surface
Coding agent
Autonomy level
Copilot with approval
Initial vector
Malicious repository project mcp config
Impact type
Remote code execution, Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
developers who open an untrusted repository in the listed CLIs; headless CI runners in a variant
Capability abused
Defense & remediation
Recorded defense
folder trust dialog
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
None for Claude Code: Anthropic declined the report as outside its threat model
Taxonomy & references
Curator notes
Adversa reports no CVE for TrustFall. CVE-2026-33068 is a separate Claude Code issue (a repository setting that skips the trust dialog, fixed in 2.1.53) that Adversa lists as an earlier, related finding and should not be attached to this record. Anthropic's position, per Adversa, is that accepting the trust prompt is consent to the full project configuration and that post-trust execution is the boundary working as designed; Adversa does not contest where Anthropic drew the line but argues the pattern recurs. Proof of concept opens a calculator; a headless variant exfiltrates environment variables from a CI runner. Demonstrated only.
Supporting sources
Cite as
Enkrypt AI. "TrustFall: project-defined MCP servers execute after a single keypress in Claude Code, Cursor CLI, Gemini CLI and Copilot CLI". AIR, AIR-2026-0252. https://agentincident.vercel.app/i/AIR-2026-0252/ (accessed 2026-10-19).