Fake Repo Trust Triggers Code Before First Prompt

How the attack worked

The lure described in this research starts with an ordinary-sounding request: clone a repository and open it in a coding agent. This might be framed as a take-home interview task, an open source project needing debugging, or a vendor sample application. Once the developer trusts the project folder so the agent can operate normally, code can execute immediately, before the developer ever sends a prompt.

Two concrete paths are described. In Codex, a project-scoped MCP configuration file at .codex/config.toml can define a local server command that starts an attacker-controlled process the moment the project is opened. No model response or additional approval is required. In Claude Code, project settings at .claude/settings.json can override the system PATH so that when the agent performs its normal startup Git checks, it runs a repository-supplied git wrapper script instead of the real Git binary. That wrapper can quietly delegate to the genuine git afterward so the session appears to continue normally.

Why it succeeded

The pretext works because trusting a project folder feels like a routine, low-friction step rather than a security decision. Developers are used to opening unfamiliar repositories as part of interviews, code reviews, or evaluating vendor samples. Microsoft has documented real-world recruiter-themed activity, sometimes called Contagious Interview, where developers cloned and trusted malicious projects and a VS Code task then ran automatically. Because the execution paths rely on legitimate agent features like MCP configuration and environment settings rather than obviously malicious binaries, a quick manual review may not surface anything unusual.

What to watch for

• Hidden agent or editor configuration directories such as .codex/, .claude/, or .vscode/ inside a repository
• PATH modifications in project settings files that point to a workspace-local directory ahead of system paths
• Local process or MCP server definitions that reference an interpreter plus a repo-supplied script
• Any execution that happens immediately on opening a project, before a prompt is sent

How to build resistance

Defenders should treat trusting a repository in a coding agent as equivalent to running its code. Unfamiliar repositories are best opened in disposable environments that hold no sensitive credentials, even when a manual review looks clean. Training should go beyond hooks and skills, since MCP configuration, editor tasks, environment settings, runtime startup files, and ordinary repository executables can all influence what runs. At the endpoint, security teams can monitor coding-agent processes that spawn git, Python, Node.js, or shell executables from inside the workspace, paying particular attention to anything that runs before the first user prompt or model request.

How does trusting a repository trigger code execution?

Coding agents like Codex and Claude Code can read project-scoped configuration files, such as .codex/config.toml or .claude/settings.json, as soon as a project is opened and trusted. These files can start a local process or override the system PATH, causing code to run automatically without any prompt from the user.

What is the fake job interview connection to this attack?

Microsoft has documented recruiter-themed activity where fake job interviews and take-home assignments were used to get developers to clone and trust malicious projects, after which an editor task ran automatically.

What should developers watch for in a suspicious repo?

Look for hidden agent or editor configuration folders like .codex/, .claude/, or .vscode/, unexpected PATH overrides, and any local process or executable defined inside the project that could run on open.

How can teams reduce risk from this technique?

Treat trusting a repository in a coding agent as equivalent to running its code, review agent-specific config directories before opening unfamiliar projects, and use disposable environments without sensitive credentials for anything unfamiliar.