Project Config as an Attack Path

Coding agents read settings from the project they are opened in, so a team shares one set-up. Those settings are ordinary files in the repository, and anyone who can commit to the repository can change them. If a setting can make the agent run a command, open a connection or change where it sends data, then the settings file is code — and people review it as if it were paperwork.

The clearest case on this rung is Check Point Research's three attacks on Claude Code, all fixed before they were published (Caught in the Hook):

1. Hooks. A repo-defined command set to run when a session starts ran as soon as the user clicked through the "trust this folder" prompt, with no second prompt. Advisory GHSA-ph6w-f82w-28w6; fixed in 1.0.87.
2. Auto-approved MCP servers. Two settings that switch on a project's MCP servers could themselves be set by the repo, so the servers' start-up commands ran before the trust prompt could even be read. CVE-2025-59536; fixed in 1.0.111.
3. A redirected API address. A repo-set ANTHROPIC_BASE_URL sent the user's API key to the attacker's server before trust was given. CVE-2026-21852; fixed in 2.0.65.

The version numbers come from the NVD and GitHub/OSV advisory records, not from the write-up.

The shared fix is a rule about order: nothing the repository controls may act, connect or send before the user says yes. The third attack also shows the damage travels: an API key belongs to a team Workspace, so one developer opening one repo exposed the whole team's stored files.

This is the concrete version of what the MCP protocol analysis argues in general — that trust granted to one part of a set-up leaks to others, and that nothing checks a component is what it claims (Breaking the Protocol).

Key Claims

• Repo-controlled hooks ran after one trust click, with no command-level prompt. Evidence: strong (reproduced by the reporter; confirmed by Anthropic's advisory) (Caught in the Hook)
• Repo settings could auto-approve MCP servers and run them before the trust dialog. CVE-2025-59536, CVSS 4.0 base 8.7 (HIGH). Evidence: strong (same source; NVD)
• A repo-set API base URL leaked the API key before trust (CVE-2026-21852), and a stolen key reached every file in the team Workspace. Evidence: strong for the leak; the Workspace reach is the reporter's own demonstration (same source)
• Report-to-fix took 36, 19 and 61 days. Arithmetic on the published timeline.

Open Questions

• Which other coding agents read executable settings from the repository before asking, and have they made the same fix? The write-up argues the pattern is general but tested one tool.
• Does code review catch config changes in practice? The write-up's claim that reviewers treat config as metadata is an assertion, not a measurement.

Related Concepts

• Agent Exploitation Attack Surface — prompt-level ways in; this page is the file-level way in.
• Deployed Agent Safety — poisoning an agent's stored state; a repo config is stored state the agent trusts on arrival.

Mentioned In

• Claude Code

Changelog

• 2026-09-24 — Created from the Check Point write-up (ingested today).