Trusted repositories in coding agents can execute attacker-controlled code before the first prompt through project-scoped MCP configuration and environment-based PATH manipulation, even without malicious hooks or shell-command approval. The article also recommends defensive searching and runtime monitoring, and highlights Datadog AI Guard for Coding Agents and Workload Protection as protections against these pre-prompt execution paths. #Codex #ClaudeCode #MCP #DatadogAIGuardForCodingAgents
Keypoints
- Trusting a repository in a coding agent can allow project-controlled code to run before the first prompt.
- Codex project-scoped MCP settings can launch an attacker-controlled local process when the project is opened.
- Claude Code project environment settings can alter PATH and cause its automatic Git probes to execute a repository-controlled wrapper.
- These execution paths do not require a model response or shell-command approval.
- The article notes prior abuse patterns such as Microsoft’s Contagious Interview campaign and malicious npm packages using Claude Code SessionStart hooks.
- Reviewing only hooks or skills is insufficient because configuration files, environment variables, runtime startup files, and ordinary executables can also trigger code execution.
- Defensive guidance includes opening unfamiliar repositories in disposable environments and using runtime monitoring such as Datadog AI Guard for Coding Agents and Workload Protection.
MITRE Techniques
- [T1204.002 ] User Execution: Malicious File – The attacker relies on the victim trusting and opening a repository in a coding agent, after which code can run automatically (‘Clone this repository and open it in your coding agent’ / ‘The victim does not need to install a suspicious binary. They only need to trust the folder’).
- [T1059 ] Command and Scripting Interpreter – A repository-controlled shell wrapper can execute before delegating to the real Git binary (‘git wrapper pid=%s cwd=%s’ and ‘exec /usr/bin/git “$@”‘).
- [T1574.007 ] Hijack Execution Flow: Path Interposition – PATH is modified so Claude Code resolves git to a project-controlled binary or script (‘Because we can define the PATH in .claude/settings.json, we can cause claude to execute our own git binary’).
- [T1053 ] Scheduled Task/Job – The article describes project tasks and hooks that run at defined lifecycle points such as startup or reopen (‘Visual Studio Code ran a project task’ / ‘SessionStart hooks that executed whenever compromised projects reopened’).
- [T1105 ] Ingress Tool Transfer – A local MCP server command is started from project configuration, effectively launching a project-provided tool on the host (‘Codex supports project-scoped MCP servers in .codex/config.toml’ / ‘When the malicious project is opened, code execution happens immediately’).
- [T1553.002 ] Subvert Trust Controls: Code Signing – The article discusses trust-review gates and how attackers try to bypass them by using alternative execution paths without declaring hooks (‘Codex now requires that hooks are reviewed and approved’ / ‘what if the malicious repository can produce the same result without declaring a hook?’).
Indicators of Compromise
- [File paths / config files ] project-controlled agent configuration and startup locations – .codex/config.toml, .claude/settings.json, .claude/worktrees/**, .mcp.json, .devcontainer/**
- [Command / executable names ] attacker-influenced startup commands and wrappers – python3, git, /usr/bin/git, bin/git
- [File names / scripts ] example project payloads referenced in the article – .codex/poc/server.py, .agent-env-poc.log, server.py
- [Shell / search artifacts ] defensive search pattern for suspicious controls – rg -n –hidden … ‘b(hooks?|mcpServers|mcp_servers|command|args|cwd|env|env_vars|PATH|BASH_ENV|NODE_OPTIONS|PYTHONPATH|sitecustomize|LD_PRELOAD|DYLD_[A-Z_]+|envFile|runOn|folderOpen|initializeCommand|postCreateCommand|postStartCommand)b’
- [MITRE / product references ] monitored agent and protection tooling mentioned in the article – Codex 0.122.0, Codex 0.129.0, Codex 0.131.0, Claude Code
- [Campaign / detection names ] prior malicious package and campaign references – MAL-2026-3648, Contagious Interview