Claude Code security: AGENTS.md, hooks and MCP config are code

Claude Code security now starts with the files in the repository. A committed .claude/settings.json can run shell commands when a session starts, .mcp.json launches server processes, and Cursor rules and AGENTS.md tell the agent what to do, including which commands to run. Attackers used these files throughout 2026. The Mini Shai-Hulud worm committed a Claude Code start-up hook to every repository a stolen GitHub token could write to.¹ In June a single Miasma commit added start-up hooks for Claude Code and Gemini CLI, an always-on Cursor rule and a VS Code folder-open task to a Microsoft repository.²

Treat these paths as code. OWASP’s GenAI Security Project published its review of the third quarter on 8 October 2026. It tells teams to review AI coding-agent configuration files as executable supply-chain artefacts, and warns that opening a cloned repository in an AI coding tool can run code without any installation step.³ In practice that means code owners for the paths, pinned MCP servers, deny-by-default permissions, isolation for code you didn’t write and a CI check that flags new hooks and MCP entries.

This post lists the files Claude Code, Cursor, Gemini CLI and Codex read and what each can make them do, the campaigns and CVEs that used them, and what each tool’s trust prompt covers. It ends with a CI sketch and a checklist. Sources are public and dated on or before 9 October 2026. Our post on AI agent containment lessons covered lab incidents and runtime controls; this one is about repository files and developer machines.

Which files coding agents read, and what each can do

Instruction files and configuration files reach your machine by different routes. An instruction file, such as AGENTS.md, CLAUDE.md or a Cursor rule, goes into the model’s context, and the model then acts through whatever tools it is allowed to use. A configuration file is executed by the tool itself. Claude Code’s own documentation draws the same line: settings files are enforced whether Claude follows them or not, and CLAUDE.md is read as guidance.⁴⁵

The main paths, as of 9 October 2026:

Sources are each vendor’s documentation, and StepSecurity for the VS Code task.^{456789101112132}

Markdown instruction files can still start commands. The AGENTS.md FAQ says an agent will try to run the programmatic checks a file lists and fix failures before it finishes, and the site says over 60,000 open-source projects use the format.¹⁴ For AGENTS.md security, read every line as something the agent may act on. Miasma’s Cursor rule was a short Markdown file that told the agent to run the payload as a setup step.²

Files also cross between tools. Cursor loads hooks from Claude Code’s .claude/settings.json and .claude/settings.local.json through a third-party import setting that is on by default, and it maps Claude’s SessionStart event to its own.⁹ GitHub Copilot accepts a root CLAUDE.md or GEMINI.md as agent instructions.¹³ A team that has standardised on one agent still has to guard the other agents’ paths. Our comparison of Claude Code, Codex and Cursor found that all three, and Pi, read AGENTS.md, so one file now steers most of a mixed team’s agents.

The 2026 AI coding agent supply chain attacks

These are the public cases from 2026 in which attackers used agent configuration files, as of 9 October:

In the April, June and August waves the files arrived as git commits, so they reached every clone and outlived the package that planted them. The hooks used SessionStart, which fires before the developer types anything, and StepSecurity notes that the April hook’s matcher made it fire for every session whatever the task.¹⁵ For Miasma, StepSecurity says cloning the repository was safe and that opening it in any of the four tools ran the payload.² The April and May commits both carried a forged author named claude, and TanStack’s post-mortem points out that the name had nothing to do with Anthropic.¹⁶

StepSecurity also reports that the April payload fetched up to 50 branches per repository and filtered them by branch protection rules before pushing.¹⁵ Branch protection that requires a reviewed pull request is the control a stolen developer token runs into, and it should cover every long-lived branch.

Deadbugz came in through the front door instead. One account opened 23 pull requests against AI and developer-tool projects on 10 August, most adding a remote MCP endpoint to the project’s configuration in what Pillar Security describes as a routine-looking change.¹⁷ None was merged. The server behaved normally for three tool calls and then changed its tool descriptions to send agents after SSH keys and cloud credentials. The containment post linked above covers that half of the attack.

Advisories where repository config ran code

Vendors have patched a steady run of bugs in which repository files ran before, or around, a trust prompt. These are the published advisories we found for Claude Code, Cursor and Gemini CLI that involve files a repository or an agent can write, as of 9 October 2026.

Sources are the vendors’ advisories, plus Check Point Research for the detail of CVE-2025-59536.^19202122

Most of the Claude Code fixes close gaps around the trust dialog, from settings read before it appeared to a crafted git file that borrowed trust from another folder. Several Cursor and Claude Code bugs run the other way: an agent, possibly steered by injected text, writes a config file that the tool later runs with fewer restrictions than the agent had. The Gemini CLI advisory, rated 10.0, is about CI and comes up again below.

An earlier Anthropic advisory, in September 2025, changed the dialog’s wording because it didn’t make clear that accepting it lets Claude Code run files in the folder without further confirmation.¹⁹ The dialog still works that way. It is one decision per repository, covering the hooks, environment values and helper commands in that repository’s settings.

Trust prompts in Claude Code, Cursor and Gemini CLI compared

Each tool now asks, or can ask, before it loads a repository’s configuration. They differ on defaults, on what happens when a trusted file changes, and on scripted runs. As of 9 October 2026:

Sources: Claude Code’s permissions, hooks and MCP docs,²³²⁴²⁵ Cursor’s security and hooks docs and advisories,²⁶⁹²¹ and Gemini CLI’s trusted-folders and hooks docs.²⁷²⁸

Cursor supports VS Code’s workspace trust but ships with it switched off. Its security page says restricted mode breaks the AI features and suggests a basic text editor for untrusted repositories.²⁶ Oasis Security showed in September 2025 that, with trust off, a .vscode/tasks.json task set to run on folder open fired without a prompt. VS Code itself enables workspace trust by default and disables agents in restricted mode.²⁹³⁰ Cursor lets agents edit workspace files without approval except configuration files, asks before every MCP connection and, since version 1.3, asks again when an MCP entry changes. Cursor describes its terminal run modes, which range from an allowlist to a classifier, as best-effort guardrails.²⁶²¹

Cursor rules are an established prompt injection channel. A rule with alwaysApply: true goes into every chat.⁷ Pillar Security’s Rules File Backdoor research in March 2025 hid instructions in rule files with zero-width joiners and bidirectional text markers, which at the time were also invisible in GitHub’s pull request view. Cursor’s response was that the risk falls on users, and GitHub added a warning for hidden Unicode text on 1 May 2025.³¹³² Cursor’s own rules page says AI guidance shouldn’t be your only security control.⁷

Gemini CLI switched folder trust on by default in v0.28.0, released on 10 February 2026, although its trusted-folders page still describes the feature as disabled by default. Check security.folderTrust.enabled in your own settings.³³²⁷ In an untrusted folder it ignores workspace settings and .env files, connects no MCP servers and loads no custom commands, project hooks or skills. It fingerprints project hooks, and a hook whose name or command changes, for example after a git pull, is treated as new and announced before it runs.²⁸ Two keys deserve a look in review. trust: true on an MCP server skips every confirmation for its tools, and tools.allowed lists tools that skip the confirmation dialog.¹¹

Codex goes furthest on the row that matters most. Trust prompts are built for a repository you open for the first time, while Mini Shai-Hulud and Miasma committed to repositories their victims already worked in and had most likely trusted long before. Codex loads a project’s .codex/ layer only when you trust the project, and it records trust against each hook’s hash, so a new or edited hook is skipped until someone reviews it in /hooks.¹² Claude Code’s documentation describes trust as one decision per repository and says settings files reload when they change. It doesn’t describe a second prompt when a pulled commit adds or edits a hook.²³²⁴

Claude Code security settings for repositories you didn’t write

Claude Code asks once per repository, so later changes to a repository’s hooks have to be caught in code review. In an interactive session, Claude Code shows the workspace trust dialog the first time you start it in a repository, keyed to the git root. Until you accept, it holds back hooks from every settings file, most env values and the repository’s allow rules. Deny and ask rules apply at once, because they only restrict.²³²⁴ Servers in .mcp.json get a separate approval prompt, and a cloned repository can no longer approve its own servers through enableAllProjectMcpServers.²⁵ Project settings also can’t set the starting mode to auto or bypassPermissions.³⁴ Accepting the dialog is the decision that matters, so read .claude/settings.json, .mcp.json and .claude/skills/ first.

Skills deserve the same reading. A ! line in a SKILL.md runs a shell command before the skill’s text reaches Claude, without a prompt, as long as your permission rules or the skill’s own allowed-tools allow it. Workspace trust never gates allowed-tools, and Anthropic’s docs warn that a skill can grant itself broad tool access.⁶

Since v2.1.283, interactive terminal and VS Code sessions start in auto mode, where a classifier model reviews actions in place of you. Manual mode asks before edits and commands, and dontAsk denies anything that would prompt, which suits CI. Anthropic says bypassPermissions belongs only in isolated containers and VMs.³⁵

In every mode except bypass, Claude Code never auto-approves writes to a list of protected paths, including .claude/, .git, .vscode, .devcontainer, .mcp.json and shell profiles.³⁵ The list doesn’t include .cursor/ or .gemini/. In acceptEdits or auto mode, a session steered by injected text could write a Cursor rule or a Gemini CLI hook without a prompt, ready for whoever next opens the repository in that tool. If your team uses more than one agent, add Edit deny rules for those paths yourself.

For a team, put the strict parts in managed settings, which a repository can’t override. This is a strict starting point:

{
  "allowManagedHooksOnly": true,
  "allowManagedPermissionRulesOnly": true,
  "disableSkillShellExecution": true,
  "allowManagedMcpServersOnly": true,
  "allowedMcpServers": [
    { "serverCommand": ["uvx", "--from", "docs-mcp==2.4.1", "docs-mcp"] },
    { "serverUrl": "https://mcp.example.com/*" }
  ],
  "permissions": {
    "disableBypassPermissionsMode": "disable",
    "deny": ["Read(.env)", "Read(.env.*)", "Read(~/.ssh/**)", "Read(~/.aws/**)",
             "Edit(.cursor/**)", "Edit(.gemini/**)"]
  }
}

allowManagedHooksOnly blocks user, project, local and plugin hooks. allowManagedPermissionRulesOnly ignores allow rules from other scopes and, from v2.1.282, the allowed-tools of project skills. disableSkillShellExecution replaces each ! line in a skill with a placeholder, and the MCP keys are covered below.²⁴⁶³⁴ Read deny rules cover Claude’s file tools, so turn on the Bash sandbox if you want the same limits enforced for shell commands.³⁶

Agents in CI read the pull request’s config

An agent that runs in CI on a pull request reads the pull request’s files. Claude Code’s claude -p and Agent SDK sessions never show the trust dialog and treat the folder as trusted. Hooks committed in the repository’s .claude/settings.json run, its env block applies and its .mcp.json servers connect without asking.²³²⁴ Anthropic gives three options for a repository you didn’t write. --setting-sources user reads neither the project’s settings files nor its .mcp.json. --bare skips the project’s hooks, skills, subagents, plugins and MCP servers, but still applies its env block. --settings '{"disableAllHooks": true}' turns hooks off for the run; the same key in your user settings isn’t enough, because project settings rank above yours and can switch hooks back on.²³ Passing the first two together keeps the project’s settings, env block, hooks, skills and MCP servers out of the run.

Gemini CLI fixed the same class of problem in April. Before 0.39.1, headless runs trusted the workspace automatically when loading configuration and environment variables, and --yolo ignored tool allowlists. Either could lead to code execution in CI, including through the run-gemini-cli GitHub Action before its 0.1.22 release, and the advisory rates the issue 10.0.²² A headless run in an untrusted folder now exits with an error unless you pass --skip-trust or set GEMINI_CLI_TRUST_WORKSPACE=true, so keep both out of jobs that handle outside contributions.²⁷

GitHub Copilot code review reads custom instructions, agent instructions and skills from the pull request’s head branch, so the change under review supplies the reviewer’s instructions.¹³

The TanStack compromise began with a pull_request_target workflow that ran code from a fork.¹⁶ For agent jobs on outside pull requests, use pull_request, give the job no secrets and a read-only token, and load configuration from the base branch.

MCP config security: pin servers and re-approve changes

An MCP entry is a command line or a URL. A stdio entry in .mcp.json, .cursor/mcp.json or .gemini/settings.json names a program, its arguments and its environment, and that program runs with your user’s access. The common npx -y package-name form names no version, so what runs is whatever version npm resolves on that machine, which could be a compromised release. Pin an exact version, install it through a lockfile or container image where you can, and change it only in a reviewed pull request.

On Claude Code, a managed allowlist turns the pin into policy. serverCommand entries match the exact command and arguments, so an entry that includes the version blocks every other version, and serverUrl entries limit remote servers to hosts you name. Set allowManagedMcpServersOnly so users can’t widen the list. Don’t rely on serverName entries, which Anthropic’s docs say are not a security control because anyone can give any server an approved name.³⁷

Remote servers can’t be pinned this way, because the code behind the URL can change at any time. Deadbugz changed its tool descriptions after the third call, so record a fingerprint of each server’s tool definitions when you approve it and require re-approval when it changes. The containment post has a short implementation. Cursor already asks again when an mcpServers entry changes.²¹ Claude Code reads credential variables as empty in a remote server’s URL and headers, so a project’s .mcp.json can’t forward your Claude Code or cloud credentials to the server it names.²⁵

A CI check that flags agent config changes

Start with ownership. Put this block at the end of CODEOWNERS, because the last matching pattern wins, and give the CODEOWNERS file an owner too. Then turn on “Require review from Code Owners” in branch protection or a ruleset for every long-lived branch.³⁸

# Agent and editor configuration. Keep this block last.
AGENTS.md        @your-org/agent-config-owners
CLAUDE.md        @your-org/agent-config-owners
GEMINI.md        @your-org/agent-config-owners
.mcp.json        @your-org/agent-config-owners
.claude/         @your-org/agent-config-owners
.cursor/         @your-org/agent-config-owners
.gemini/         @your-org/agent-config-owners
.codex/          @your-org/agent-config-owners
.vscode/         @your-org/agent-config-owners
.devcontainer/   @your-org/agent-config-owners
/.github/        @your-org/agent-config-owners

Then add a check that makes each change visible. This GitHub Actions job runs on pull_request, which gives pull requests from forks no secrets and a read-only token. It warns on every changed file under those paths. It fails when an added line brings in a hook, an MCP server, a task, an always-on rule or a permission change, or when a file contains zero-width, bidirectional-control or tag characters.

name: agent-config
on: pull_request
permissions:
  contents: read
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Flag agent config changes
        env:
          BASE_REF: ${{ github.base_ref }}
        run: |
          paths='(^|/)(AGENTS|CLAUDE|GEMINI)\.md$|(^|/)\.mcp\.json$|(^|/)\.(claude|cursor|gemini|codex|vscode|devcontainer)/|^\.github/'
          risky='"hooks"|mcp(json)?servers|"command"|"url"|"env"|runon|alwaysapply|allowed-tools|"allow"|defaultmode|apikeyhelper|base_url|"trust"'
          files=$(git diff --name-only --diff-filter=d "origin/$BASE_REF...HEAD" | grep -E "$paths" || true)
          [ -z "$files" ] && exit 0
          status=0
          for f in $files; do echo "::warning file=$f::Agent config changed. A code owner should review it."; done
          if git diff "origin/$BASE_REF...HEAD" -- $files | grep -E '^\+[^+]' | grep -iE "$risky"; then
            echo "::error::Adds hooks, MCP servers, tasks, rules or permissions"; status=1
          fi
          # Zero-width, bidi-control and tag characters hide text from reviewers
          perl -CSD -ne '
            if (/[\x{200B}-\x{200F}\x{202A}-\x{202E}\x{2060}-\x{2064}\x{2066}-\x{2069}\x{FEFF}\x{E0000}-\x{E007F}]/) {
              print "::error file=$ARGV,line=$.::Invisible characters\n"; $bad = 1 }
            close ARGV if eof; END { exit $bad }' $files || status=1
          exit $status

A pull request can edit this workflow, and on pull_request the edited version is what runs, which is why /.github/ sits in the code-owners block. The pattern match doesn’t parse JSON or judge intent, and it will flag some harmless changes. Keep the check visible but optional, and let the code-owner rule decide who approves.

If you opened an affected repository

StepSecurity’s guidance for anyone who opened an affected repository in VS Code, Claude Code, Cursor or Gemini CLI after 2 June is to treat the machine as compromised.² Combined with Snyk’s ordering advice, the response looks like this:³⁹

1. Disconnect the machine or CI runner from networks that hold secrets.
2. Search your repositories and home directory for unexpected .claude/, .gemini/, .cursor/ or .vscode/tasks.json files, and for scripts they call, such as .github/setup.js.
3. Remove the hooks, tasks and rules before rotating anything.
4. Rotate GitHub, npm, PyPI, SSH, cloud and Kubernetes credentials that the machine could reach, including roles a CI runner can assume.
5. Check your packages for versions that have no matching tag or CI run, which StepSecurity suggests as a signal of an unauthorised publish.
6. Pin GitHub Actions to commit SHAs so a replaced tag can’t change what runs.

Checklist before an agent opens a repository

1. Own the paths. Code owners for agent and editor configuration, required code-owner review on every long-lived branch, and an owner for CODEOWNERS itself.
2. Update the agents. The fixes above need at least Claude Code 2.1.84, Cursor 3.0.0 and Gemini CLI 0.39.1. Check the versions pinned in CI images and dev containers too.
3. Switch trust on. Enable Cursor’s workspace trust, by MDM across a fleet. Confirm security.folderTrust.enabled in Gemini CLI. Read .claude/, .mcp.json and the skills folder before accepting Claude Code’s dialog.
4. Deny by default. Managed settings for hooks, allow rules and MCP servers; deny reads of .env files, ~/.ssh and cloud credential folders; bypassPermissions and --yolo only on isolated machines.
5. Pin MCP servers. Exact versions in every entry, exact-command allowlists, and fingerprints of remote tool definitions with re-approval when they change.
6. Isolate code you didn’t write. Open it in a disposable VM or container that holds no credentials and has limited egress, built from your own definition. A repository’s devcontainer.json can run its initializeCommand on the host during initialisation.⁴⁰ Anthropic’s dev container docs warn that, run with --dangerously-skip-permissions, a container won’t stop a malicious project from taking whatever is inside it, Claude Code’s credentials included.⁴¹
7. Keep secrets out of reach. Don’t mount ~/.ssh or cloud credential files into agent containers, prefer short-lived repository-scoped tokens, and keep long-lived tokens out of the shell environment an agent inherits.⁴¹
8. Lock down CI. pull_request with no secrets for outside contributions, --setting-sources user with --bare and --permission-mode dontAsk for claude -p, no --skip-trust for Gemini CLI, and configuration from the base branch.
9. Scan every pull request. Flag added hooks, MCP entries, folder-open tasks, always-on rules, permission changes and invisible characters, as the job above does.
10. If a worm reached you, remove persistence first. Snyk advises clearing planted hooks from agent and editor config before rotating credentials.¹ Search repositories for SessionStart hooks and folder-open tasks, run git log --all --author=claude@users for forged commits, then rotate everything the machine could reach.¹⁵

Frequently asked questions