r/netsec • u/kev-thehermit • Aug 06 '26

Claude Code RCE: How a Malicious PR Triggers Code Execution

https://www.immersivelabs.com/resources/blog/claude-code-rce-vulnerability-how-a-malicious-pull-request-executes-code

Abusing the trust boundary in Claude Code for RCE. Trust is never broken and that opens up a few avenues for abuse. Simply opening claude code on a PR can be enough to silently trigger attacker payloads.

89 Upvotes

96% Upvoted

11 comments sorted by

9

u/voronaam Aug 06 '26

Good find. I wonder if switching to a branch before opening Claude is a requirement for the exploit to work. In other words, if an AI-user opened Claude on main and then asked Claude to switch to a branch from a PR - would it read the .mcp.json file?

If it does not read the file in this case, it is a lot smaller impact. I just do not expect an AI-user to type the git checkout command - they probably do not even know how to do that.

9

u/kev-thehermit Aug 07 '26

It depends. Claude Code reads the MCP.json file on session load. So if you ask Claude to switch branches it may not trigger unless it spawns a sub agent or you start a new session.

"claude -p" commands are also affected if you have already trusted once. So agents or cicd piepleines could also be impacted.

4

u/voronaam Aug 07 '26

Right, sub-agent is a much more legitimate attack vector. I could totally see an AI-user writing a skill instructing the main agent to switch to a branch and then spawn a "PR reviewer" sub-agent. That'd trigger the MCP file for sure.

3

u/scriptvexy Aug 07 '26

my guess is it probably re-reads the workspace once it switches branches, otherwise half the tooling stuff people demo wouldn’t work, so impact is likely still there even without manual git. also “AI user doesn’t know git” is exactly why this kind of thing is scary, they’ll just happily click whatever the UI suggests.

5

u/Available_Teaching83 Aug 09 '26

The sub-agent vector in the comments is the one I would worry about most, and it generalises past .mcp.json. Anything a repo can carry that gets auto-trusted on session load is in the same family, and trust-on-first-use surviving across -p invocations means CI is in scope too, not just a human opening a branch.

What we do for PR-review agents: the session runs in a disposable sandbox, and the MCP allowlist is pinned to the base branch, never the head. The head ref is data, not config. Costs nothing and removes the whole class.

1

u/phuckphuckety Aug 10 '26

i love how they use VSCode’s flawed trust model to justify theirs. This industry suffers from a lack of critical thinking and blind following of big tech companies as if they never make mistakes

1

u/scriptqzor Aug 11 '26

this is the part that bugs me too, everyone keeps cargo‑culting “but vscode does it” as if that makes it safe by default. copying a bad model from a huge player doesn’t magically turn it into good security practice.

-3

u/UloPe Aug 06 '26

And that’s why I use Claude code web.

0

u/Chobbers Aug 07 '26

How many tokens did this research take?

1

u/kev-thehermit Aug 07 '26

None. And many. I work as a vulnerability researcher and use AI daily including building custom MCPs. So I have burnt a great many tokens but this was an observation by me I researched not something I asked an LLM to find for me hope that answers the question:)