AI Coding CLI Tools Vulnerable to One‑Keypress Remote Code Execution via Malicious Repositories
What Happened — Researchers at Adversa AI disclosed a design flaw (named “TrustFall”) affecting four popular command‑line AI coding assistants—Claude Code, Gemini CLI, Cursor CLI, and GitHub Copilot CLI. A malicious repository can trigger the tools to launch attacker‑controlled helper programs simply by opening the folder and confirming a default‑yes trust prompt, resulting in immediate code execution with the developer’s privileges.
Why It Matters for TPRM —
- The vulnerability bypasses the usual “review‑before‑run” safeguard, exposing any downstream organization that integrates these tools into its development pipeline.
- Compromise of a single developer workstation can lead to theft of SSH keys, cloud credentials, source code, and lateral movement across corporate networks.
- The issue spans multiple vendors, creating a supply‑chain risk that can affect any third‑party software development engagement.
Who Is Affected — Technology & SaaS vendors, software development firms, MSPs that provide development environments, and any organization that allows developers to use AI‑assisted CLI tools.
Recommended Actions —
- Immediately audit CI/CD pipelines and developer workstations for usage of Claude Code, Gemini CLI, Cursor CLI, or Copilot CLI.
- Enforce a policy to disable automatic trust prompts or require manual review of project configuration files before execution.
- Apply vendor‑issued mitigations (e.g., updated dialogs, optional MCP disable) and monitor for patches.
- Conduct credential rotation for any accounts that may have been accessed from compromised machines.
Technical Notes — The flaw exploits the Model Context Protocol (MCP), which allows AI assistants to invoke external helper programs defined in a project’s configuration file. Attackers supply two tiny JSON files: one defining a malicious helper script, the other auto‑approving it. Because the trust dialog defaults to “Yes,” the helper runs with the developer’s permissions, enabling credential theft, data exfiltration, and persistence. No CVE has been assigned yet; vendors are expected to release patches in the coming weeks. Source: Help Net Security