Before the First Prompt Code Execution Paths in Trusted Codi...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://securitylabs.datadoghq.com/articles/coding-agent-project-trust-code-execution-before-first-prompt
• Blog Title: Before the First Prompt: Code Execution Paths in Trusted Coding-Agent Projects
• Suggested Section: AI Security -> AI MCP Security, with a new subsection on repository-controlled pre-prompt code execution in coding agents; cross-reference Phishing Methodology -> AI Agent Abuse Local AI CLI Tools and MCP

🎯 Content Summary

The article demonstrates two repository-controlled code-execution paths in coding agents. After a developer clones an attacker-controlled repository, opens it in Codex or Claude Code, and approves project trust, repository-supplied configuration can execute arbitrary local code before the first user prompt, model response, MCP tool call, or generated shell-command approval. The payload runs in the coding agent's security context and can therefore interact with files, credenti...

🔧 Technical Details

Project-scoped MCP startup execution: If a coding agent supports repository-scoped local stdio MCP servers, trusting and opening the repository may automatically start the configured operating-system process. An attacker can define an interpreter such as python3 as the MCP command and supply a repository-controlled script through args. The payload runs during MCP initialization without a prompt, model response, MCP tool invocation, or generated-command approval. This can bypass controls that apply an additional review only to explicit command hooks.

PATH hijacking of automatic agent commands: When project configuration controls the coding agent's environment, prepend a repository directory such as ./bin to PATH and place a tracked executable whose name matches a command automatically launched by the agent. If the agent executes git without an absolute path, 🤖 Agent Actions

Updated src/AI/AI-MCP-Servers.md with:

• Codex project-scoped stdio MCP pre-prompt execution.
• Claude Code PATH hijacking through project settings.
• Environment-variable startup injection primitives.
• Static repository triage and runtime detection guidance.
• Technical containment recommendations.
• Cross-reference to the local AI CLI/MCP phishing page.
• Numbered citations to the Datadog research and official documentation.

Validation passed for Markdown fences, internal links, references, forbidden sources, and git diff --check. mdbook build could not run because mdbook is not installed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://securitylabs.datadoghq.com/articles/coding-agent-project-trust-code-execution-before-first-prompt

Content Categories: Based on the analysis, this content was categorized under "AI Security -> AI MCP Security, with a new subsection on repository-controlled pre-prompt code execution in coding agents; cross-reference Phishing Methodology -> AI Agent Abuse Local AI CLI Tools and MCP".

Repository Maintenance:

• MD Files Formatting: 1029 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0