security

Security biz Adversa AI argues users of AI tools need clearer warnings

How explicit does the maker of a footgun need to be about the product's potential to shoot you in the foot?

That's essentially the question security firm Adversa AI is asking with the disclosure of a one-click remote code execution attack via an MCP server in Claude Code, Gemini CLI, Cursor CLI, and Copilot CLI.

The TrustFall proof-of-concept attack demonstrates how a cloned code repository can include two JSON files (.mcp.json and .claude/settings.json) that open the door to an attacker-controlled Model Context Protocol (MCP) server.

MCP servers make tools, configuration data, schemas, and documentation available in a standard format to AI models via JSON.

The vulnerability arises from inconsistent restrictions governing the scope of settings: Anthropic blocks some dangerous settings at the project level (e.g. bypassPermissions) but not others (e.g. enableAllProjectMcpServers and enabledMcpjsonServers).…