A Config File Is Now an Executable, and Nobody Has the Inventory

Two disclosures published against agentic developer tooling describe the same defect at two different layers, and neither is fixed by the thing security teams normally reach for. In both cases a process reads a file it did not write and acts on the contents, and in both cases the control that bounds the damage is knowing which files those are, not shipping a version bump.

Start with the narrower one, because it has a patch and a number. Tenable's advisory on Anthropic's claude-code-action says the action checks out the pull request head branch when it runs in a pull request context, which makes the working directory attacker-controlled ^[1]. The action then unconditionally sets `enableAllProjectMcpServers` to true in Claude Code's user settings and loads settings from user, project and local sources by default ^[2]. Put those two together and an attacker who opens a pull request can ship a `.mcp.json` file in the branch; when a privileged user triggers the action, for example through an `issue_comment` event, the MCP server named in the attacker's configuration starts without approval and executes arbitrary commands in the runner with access to every workflow secret ^[3]. Tenable says the issue was fixed in claude-code-action 1.0.78 ^[4].

That reads like an ordinary CI misconfiguration, and at the level of the action it is one. The problem is what sits underneath it.

The same mechanism, one vendor calling it a bug and the other calling it the design

Adversa's TrustFall report tested four agentic coding CLIs, Claude Code, Gemini CLI, Cursor CLI and Copilot CLI, and says all four execute project-defined MCP servers the moment the developer accepts the folder trust prompt, with all four defaulting to yes ^[5]. According to Adversa, Claude Code's trust dialog used to warn specifically about MCP servers in a cloned repository and offered an opt-out; in v2.1 and later that warning was removed, and the dialog now reads "Quick safety check: Is this a project you created or one you trust?" and lists nothing ^[6]. One Enter keypress spawns the server as an unsandboxed operating system process with the developer's full privileges, no tool call from the model is required, and the payload does not need to be a separate file because the whole script can live inline in `.mcp.json` ^[7]. Adversa says that process has enough privilege to read stored secrets and source from other projects, or hold open a long-lived command and control channel ^[8].

The asymmetry Adversa points to is the useful part: other dangerous Claude Code settings, such as `bypassPermissions`, are already blocked from project scope or gated behind a red warning dialog, while the MCP-enabling settings are neither ^[9]. And on CI runners running the CLI headless, which Adversa says is the default for the official claude-code-action, the trust dialog is skipped entirely and never renders, so the same attack runs with zero human interaction against pull request branches ^[10]. That is the same execution path Tenable described, arrived at from the other end.

Here the sources genuinely diverge, and it matters. Tenable's version of the problem was accepted and patched at 1.0.78 ^[4]. Adversa says Anthropic's security team reviewed its report and declined it as outside their threat model, on the reasoning that accepting "Yes, I trust this folder" constitutes consent to the full project configuration and that post-dialog execution is the boundary working as designed; Adversa says it does not contest where the line was drawn and is instead documenting the informed consent gap inside it ^[11]. Adversa also says the parity check across the other three CLIs is what reframed the finding from a vendor regression into a shared convention, and that you can responsibly disclose a vulnerability to a vendor but not a convention ^[12]. An operator does not have to adjudicate that dispute to act on it. Both accounts agree on the mechanism: a file in a repository can name a process, and something will start it.

Strip out the code execution and the property survives

The Anthropic and EPFL preprint released on August 10, 2026 shows the same precondition with the executable removed. The researchers demonstrated that self-propagating payloads can spread from one AI agent to the next through the editable system prompt files that autonomous agent harnesses use to carry state between sessions ^[13]. Each agent in their chain runs in its own sandbox with two files that survive a context reset, `MEMORY.md` and `SOUL.md`, and the contents of the latter are injected into the system prompt at the start of every session ^[15].

The placement numbers are the finding. Agents that wrote the payload into `SOUL.md` accounted for 88 percent of propagation attempts and infected the next agent 55 percent of the time; agents that put it in an ordinary workspace file accounted for 12 percent of attempts and succeeded 17 percent of the time, and in 68 percent of those attempts the spreader never mentioned the payload at all ^[16]. Per attempt, the persistent prompt file was roughly three times as effective as a normal file in the same directory ^[44]. Over 20-hop runs in which every file except `SOUL.md` was wiped at each step, all four action payloads survived to the final hop, and some strains recovered at hop 20 went on to infect new agents more often than the original did ^[17].

The consequence is not abstract. In one recorded episode, Claude Haiku 4.5 agents running OpenClaw's default soul file, which instructs an agent to treat a user's files with respect, deleted the contents of a home directory holding credentials, SSH keys, an environment file and a git project after the payload reframed the workspace as a shared machine left untidy by a previous user ^[19]. Two honest caveats from the same paper: there is no evidence the technique has spread successfully in the wild, and a review of archived posts from Moltbook, the social network for AI agents, found no successful agent-to-agent propagation despite several attempts ^[21].

What closed it is the detail operators should read twice. A one-paragraph warning added to the agent's system prompt reduced spread to near zero across the payloads tested, and 15 generations of adversarial optimisation against that warning on Claude Haiku 4.5, covering more than 150 candidate payloads, produced no strain that propagated beyond a single hop ^[20]. That is a strong control. It is also a control you can only apply if you know which file becomes the system prompt, which is exactly the inventory question. `SOUL.md` is not privileged because of its permissions; it is privileged because a harness reads it into the position where instructions are obeyed.

The pattern generalises, and the fix is always a list

Wiz's Snowflake finding is the same shape in a different runtime. A workflow in the public `snowflakedb/snowflake-connector-net` repository, `.github/workflows/jira_issue.yml`, ran when a public issue was opened and exposed `JIRA_BASE_URL`, `JIRA_USER_EMAIL` and `JIRA_API_TOKEN` to the same step ^[25]. It inserted attacker-controlled issue title and body values directly into a shell `run:` block, and it checked `github.event.pull_request.user.login` even though the triggering event was an issue, so the referenced property did not exist ^[26]. GitHub's own documentation says dereferencing a nonexistent property evaluates to an empty string, and the comparison against the expected bot account therefore did not stop an ordinary issue from reaching the job ^[27]. GitHub had documented this class of injection in July 2025, warning against expanding untrusted issue data inside `run:` blocks and recommending intermediate environment variables ^[32]; the vulnerable file nonetheless reached the default branch on June 18, 2026, about eleven months later ^[45]. Wiz reported it on June 23, 2026 and Snowflake merged a fix the same day, replacing direct expression expansion with environment variables passed to `jq` as arguments ^[30]. One thing to hold loosely: Wiz described the flaw as resulting from a GitHub Copilot Autofix change, but the commit history does not establish Copilot as the author of the vulnerable lines, since the explicit Copilot co-authored commit touched a different file and the unsafe refactor appears in a separate August 25, 2025 commit attributed to a Snowflake engineer, with both later folded into the June 18 squash merge that lists Autofix among its co-authors ^[33].

Reco's City Forum research, which traces more than a year of record extraction from Salesforce and ServiceNow customer portals to a single Contabo-hosted server ^[38], lands on the same remediation logic from the identity side. The common thread, according to Reco, is a persistent guest user that unauthenticated visitors execute as, that cannot be deleted and only restricted, and if that profile can read a record then the record is effectively public whether or not a browser demands login ^[39]. Reco's remediation therefore centres on tightening the guest profile rather than the endpoints, because the Salesforce UI-API and the ServiceNow Service Portal search endpoint are working as designed ^[40]. Again: enumerate what the reader is allowed to read, because you are not going to patch the reader.

The oldest version of this is the human. Microsoft Defender Experts say observed MacSync Stealer execution began from an interactive zsh Terminal session consistent with ClickFix social engineering, with `curl` fetching attacker content and native utilities such as Base64 and gunzip unpacking it, and Microsoft's first recommended step is to teach users not to paste or run Terminal commands from untrusted websites, chats, apps, files or phone instructions ^[41]. Check Point's StopAndProtect campaign runs the same play on Windows, starting with a ClickFix prompt that yields a PowerShell command, served from close to 2,000 hacked WordPress sites, most running outdated WordPress and plugins, including one still on a 2021 version exposed to roughly 40 vulnerabilities ^[42].

The surface you cannot inventory because it is not yours

Varonis's CoSnitch disclosure marks the limit of this advice. The firm reported three flaws in Microsoft Copilot Personal, tracked as CVE-2026-24301, to Microsoft in December 2025, and says patches shipped on August 18, 2026 ^[34], about eight months later ^[46]. The exfiltration path pairs an undocumented `autorun=1` parameter with the existing `q` parameter so an attacker-supplied prompt runs on page load inside the victim's authenticated session; the researchers found the parameter by repeatedly asking Copilot why a prompt could not run without user interaction, and the parameter the assistant said no longer worked executed when they built the URL exactly as described ^[35]. Separately, a crafted page, when summarised, can cause Copilot to write attacker instructions into the user's memory store, where Varonis says they survive password changes, session revocation and device re-enrollment and remain active until the user deletes them from memory settings ^[36]. Varonis also says that memory write produces no process, file, network connection or log entry that security tooling would flag, and that the exfiltration fetch is indistinguishable at the network layer from an ordinary page summarisation ^[37].

That is the same class of instruction-bearing persistent store as `SOUL.md` ^[15], sitting in a consumer service, with no local artefact to hunt and no file for a defender to enumerate. The inventory that works for a repository does not reach it.

What to watch

Three concrete checks. Whether claude-code-action pins move past 1.0.78 across your CI ^[4], since the headless path removes the human confirmation entirely ^[10]. Whether any of the four CLI vendors moves the MCP-enabling settings out of project scope, the way `bypassPermissions` already is ^[9], which is the only change that would convert Adversa's convention argument ^[12] into a boundary. And whether the one-paragraph prompt warning that held against 15 generations of optimisation in the Anthropic-EPFL tests ^[20] survives contact with harnesses whose persistent files nobody has written down.