Anthropic Claude Code RCE Flaw Can Turn Pull Requests Into an Attack
Security researchers have demonstrated a Claude Code remote code execution risk where a malicious pull request can add project-level MCP configuration that runs code on a developer’s machine when Claude Code starts.
The uncomfortable part is that the trigger can arrive after a repository was already trusted, which turns a normal branch switch into the moment worth watching.
➜ The real story: AI coding agents are making “configuration” feel less like settings and more like executable software, and one-time trust decisions are starting to look way too broad.
The scenario was documented by Immersive Labs researcher Kevin Breen and picked up by GBHackers. According to the disclosure, Anthropic considers the behavior part of Claude Code’s workspace trust model rather than a new security boundary being crossed.
How the Claude Code RCE Attack Uses MCP and Malicious Pull Requests
Claude Code can use project-scoped Model Context Protocol configuration stored in a .mcp.json file.
The research shows that a pull request can introduce a local MCP server definition whose command starts when Claude Code initializes the project, potentially before the developer asks the agent to review anything.
Because that process runs with the developer’s existing privileges, exposed environment variables, SSH keys, cloud tokens and other local credentials can become part of the blast radius. That’s what makes this feel less like a quirky AI edge case and more like a software supply-chain problem wearing an agent badge.
Why Anthropic Claude Code Workspace Trust Is the Bigger Security Issue
The debate here is really about what “trust this folder” should mean once the code inside that folder changes.
The response from Anthropic in the disclosure says trust covers repository configuration and content later checked out into that directory, including other branches, while Anthropic’s current security guidance says first-time codebases and new MCP servers use trust verification.
The researcher’s concern is that a trusted repo can still receive new executable agent configuration during a normal pull-request workflow without forcing a fresh trust decision tied to that exact change.
In other words, the old desktop idea of trusting a workspace gets much heavier when the workspace can launch tools on your behalf.
What Claude Code Developers Should Do About Malicious MCP Configuration
The practical move is to treat agent configuration like code, not like harmless project metadata.
Changes to .mcp.json, .claude settings, hooks, IDE configuration and workflow files deserve the same review energy as anything that can execute locally, especially before switching to an unfamiliar pull-request branch.
Isolated development containers or virtual machines can lower the stakes, and limiting long-lived credentials in a developer shell makes a successful attack less valuable.
AI coding agents are still worth using, but the security model has to catch up with how much authority we’re handing them.
FAQs
What Is the Claude Code RCE Flaw?
It’s a reported remote code execution risk involving project-level MCP configuration that can cause a local command to run when Claude Code starts inside a previously trusted repository.
Can a Malicious Pull Request Execute Code Through Claude Code?
In the demonstrated scenario, yes. A pull-request branch can introduce a malicious .mcp.json configuration that starts a local MCP process when Claude Code opens the project.
Has Anthropic Fixed This Claude Code Security Issue?
The August disclosure says Anthropic classified this specific behavior as working as designed under its workspace trust model, so the report did not describe a dedicated fix for this exact scenario.
