Claude Code trust prompt can trigger one-click RCE
Anthropic response to 1-click pwn: Shouldn't have clicked 'ok'
Security biz Adversa AI argues users of AI tools need clearer warnings
How explicit does the maker of a footgun need to be about the product's potential to shoot you in the foot?
That's essentially the question security firm Adversa AI is asking with the disclosure of a one-click remote code execution attack via an MCP server in Claude Code, Gemini CLI, Cursor CLI, and Copilot CLI.
The TrustFall proof-of-concept attack demonstrates how a cloned code repository can include two JSON files (.mcp.json and .claude/settings.json) that open the door to an attacker-controlled Model Context Protocol (MCP) server.
MCP servers make tools, configuration data, schemas, and documentation available in a standard format to AI models via JSON.
The vulnerability arises from inconsistent restrictions governing the scope of settings: Anthropic blocks some dangerous settings at the project level (e.g. bypassPermissions) but not others...
Copyright of this story solely belongs to theregister.com. To see the full text click HERE
