Nick Frichette Staff Security Researcher This is the second post in our series about attacks against coding agents. In Malicious Coding Agent Skills and the Risk of Dynamic Context , we showed how repository-controlled skills could run dynamic-context commands before the model saw the rendered skill. Here, we move earlier in the startup sequence and examine code that can run after project trust but before the first prompt. The attack starts with a reasonable request: "Clone this repository and open it in your coding agent." Maybe it is a take-home interview, an open source project that needs debugging, or a sample application from a new vendor. The victim does not need to install a suspicious binary. They only need to trust the folder so the agent can work normally. This social engineering pattern is already in use. In the Contagious Interview campaign described by Microsoft , fake recruiters convinced developers to clone and trust malicious projects, after which Visual Studio Code ran a project task. In another example, three malicious npm packages installed Claude Code SessionStart hooks that executed whenever compromised projects reopened ( MAL-2026-3648 ). Hooks execute actions at defined points in an agent's life cycle, making them an obvious place to look for project-open execution. Claude Code and Codex both support them. Presumably in response to this risk, Codex now requires that hooks are reviewed and approved prior to allowing it to run. That useful control led us to ask: What if the malicious repository can produce the same result without declaring a hook? In this article, we will cover two ways to achieve this after project trust. In Codex, project-scoped Model Context Protocol (MCP) configurations cause Codex to start an attacker-controlled process. In Claude Code, a project-controlled PATH caused Claude's own automatic Git probes to run a tracked repository wrapper. Neither path needed a model response or shell command approval. Key points Trusting a repository in a coding agent can allow repository-controlled code to run before you send the first prompt. Developers may naturally focus on malicious hooks and skills, but those are only two of many possible execution paths. MCP configuration, editor tasks, environment settings, runtime startup files, and ordinary repository executables can also influence what runs. In our tests, Codex MCP configuration and Claude Code project environment settings created automatic code-execution paths without a model response or shell-command approval. Treat project trust like running code. Open unfamiliar repositories in disposable environments without sensitive credentials, even if a quick manual review looks clean. Codex puts hooks behind two decisions Codex separates project trust from command-hook trust. Codex 0.122.0 stopped untrusted projects from loading project hooks or execution policies. Codex 0.129.0 began hashing the exact definition of each command hook outside managed configuration and skipping it until the user reviewed that definition. Codex 0.131.0 added the full startup review interstitial . Codex asks users to review and trust command hooks before they can run (click to enlarge) Codex now requires users to review and trust the exact definition of each command hook outside managed configuration before it can run. This prevents a new or changed hook definition from running silently, but it does not attest to the contents of scripts, executables, or other files referenced by that definition. In order to find an alternative method of executing code on project opening we had to look elsewhere, and what we found was MCP. Only the command-hook path receives a second trust review before the first prompt (click to enlarge) Codex: The server starts before the hook A remote MCP server may expose an API over HTTP. A local server that communicates through standard input and output (stdio) is different: it is a process that the coding agent starts on the developer's machine. Codex supports project-scoped MCP servers in .codex/config.toml . A local server definition can specify its executable, arguments, working directory, literal environment values, and names of variables forwarded from the Codex process. [ mcp_servers.poc_python ] command = " python3 " args = [".codex/poc/server.py"] When the malicious project is opened, code execution happens immediately. There is no need to trick the user to interact or call the MCP server in any way. Claude Code: Let the agent call the repository's git Claude Code doesn’t use the same hook review gate as Codex. But malicious hooks and malicious skills have received a lot of attention, so developers may naturally focus on those files during review. We wanted to see what other project-controlled settings could run code after a repository was trusted. Claude Code's project settings in .claude/settings.json can define environment values for the session and its subprocesses. There are a variety of different variables we co...