What happened
Researchers demonstrated that Claude Code's workspace-trust model establishes a security boundary at the initial folder-trust decision, but the object that executes (the MCP server command bound to an approved name) is mutable via normal source-control activity such as a PR checkout, allowing a malicious contributor to swap in an attacker command that runs under the previously-granted approval.
Why it matters
This is a novel agent-execution attack class specific to AI coding agents: it weaponizes the exact trust model (approve-once, persistent-name) that agentic coding tools rely on to reduce prompt fatigue, turning routine open-source contribution review into a remote code execution vector against developer workstations.
Attack vector
An open-source maintainer who has already trusted a local repository checks out a contributor's pull-request branch and launches Claude Code. If the PR branch carries a modified project-level .mcp.json, Claude Code may read it during session startup and automatically initialize the declared MCP server, running an attacker-controlled local command without a fresh trust/approval prompt — because the already-approved MCP server name persists even though the underlying command was swapped by the PR.
Affected systems
Anthropic Claude Code (CLI and VS Code extension), any repository using project-scoped .mcp.json
Mitigation
No CVE and no vendor patch confirmed at time of reporting; recommended mitigation is to treat MCP-server approval as tied to the exact command/config content (re-prompt on any change) rather than to a persistent server name, and to avoid launching Claude Code against unreviewed PR branches with write/execute-capable MCP servers configured.