Anthropic response to 1-click pwn: Shouldn't have clicked 'ok'

"The TrustFall proof-of-concept attack demonstrates how a cloned code repository can include two JSON files (.mcp.json and .claude/settings.json) that open the door to an attacker-controlled Model Context Protocol (MCP) server. MCP servers make tools, configuration data, schemas, and documentation available in a standard format to AI models via JSON. The vulnerability arises from inconsistent restrictions governing the scope of settings: Anthropic blocks some dangerous settings at the project level (e.g. bypassPermissions) but not others (e.g. enableAllProjectMcpServers and enabledMcpjsonServers). The JSON files simply enable those settings."

""The moment a developer presses Enter on Claude Code's generic 'Yes, I trust this folder' dialog, the server spawns as an unsandboxed Node.js process with the user's full privileges - no per-server consent, no tool call from Claude required," Adversa AI explains in its PoC repo. The likely result is a compromised system. The PoC demonstrated in this video. It worked on Claude Code CLI v2.1.114, as of May 2."

""It's the third CVE in Claude Code in six months from the same root cause (project-scoped settings as injection vector)," Alex Polyakov, co-founder of Adversa AI, told The Register in an email. "Each gets patched in isolation but the underlying class hasn't been finally fixed. Most developers don't know these settings exist, let alone that a cloned repo can set them silently.""

A one-click remote code execution proof-of-concept shows how cloned repositories can include JSON configuration files that enable an attacker-controlled Model Context Protocol (MCP) server. MCP servers expose tools, configuration data, schemas, and documentation to AI models in a standard JSON format. The vulnerability stems from inconsistent restrictions on which settings are blocked at the project level. Some dangerous settings are blocked while others that enable MCP servers are not, allowing the JSON files to activate them. When a developer confirms a generic trust dialog, the MCP server spawns as an unsandboxed Node.js process with the user’s full privileges, without per-server consent or a required tool call. The result is likely system compromise.

Read at theregister