A cloned repository can run commands in your editor

In early 2026 Check Point Research published two vulnerabilities in Claude Code. The first, CVE-2025-59536, scored 8.7 and gave an attacker remote code execution when a developer simply opened a cloned repository. The second, CVE-2026-21852, let that same repository override where prompts and the API key header were sent. Both were reported to Anthropic, fixed in collaboration with its security team, and patched before the write-up went out. If you are current, you are not exposed to either.

The reason to keep reading is not that one vendor had a bug. It is what the bug was made of. Your editor reads configuration out of the project directory: hooks, MCP server definitions, environment variables. That configuration is executable, and it arrives with the repository. Cloning used to be safe because cloning did not run anything. That has quietly stopped being true, across every tool in this category.

This is not one vendor's problem

The Cloud Security Alliance counted at least seven confirmed high or critical CVEs across tools that implement the Model Context Protocol, between April 2025 and May 2026. Cursor is in that list, under CVE-2025-54136, nicknamed MCPoison. So are Windsurf, LibreChat, MCP Inspector, and LiteLLM, whose entry is the one rated critical. Picking a different editor moves you to a different line of the same table.

The common root is the protocol's standard transport, which passes configuration parameters to the operating system shell without sanitising them. Anthropic has confirmed that behaviour is intentional and has declined to change it at the protocol level, placing the responsibility on the tools that implement it. That is worth knowing plainly: it is a design decision you inherit, not a defect that a future patch removes.

Three shapes the attack takes

• Tool poisoning. Instructions hidden in a tool description that the model reads and the interface never shows you. You approve a name; the model acts on a paragraph you did not see.
• The rug pull. A server offers genuinely useful tools, earns your approval once, and changes what those tools do afterwards. Approval is granted to a name, not to a behaviour.
• Cross-server shadowing. One malicious server redefines the agent's understanding of a neighbouring trusted tool, so the compromise does not stay in the component you added.

None of these require you to install something obviously bad. They require you to have connected several things that are each individually reasonable. A July 2025 scan found 1,862 MCP instances reachable on the public internet with no authentication at all, which suggests the average configuration gets less review than the average dependency.

What to do this week

1. 1Update the editor and the agent. Both Claude Code issues are patched, and so are most of the seven.
2. 2Take production credentials off the machine that opens other people's repositories. This single change makes the entire class of attack expensive rather than catastrophic, and it is the same fix as for the credential problems that predate agents.
3. 3List the MCP servers your editor can actually reach. Remove the ones nobody has used this quarter, and pin the versions of the ones that stay.
4. 4Treat a cloned repository as untrusted input. Read its agent configuration before opening it in an editor that has an agent, the same way you would skim a package's install script.
5. 5Give the agent its own database role with only the grants it needs, so the blast radius is defined by permissions rather than by intent.

The part that generalises

Every item on that list is a permission, not an instruction. You do not stop this by telling an agent to be careful, or by trusting a repository because it has stars. You stop it by arranging things so that the machine holding your customer database is not the machine that opens code from strangers, and so that the role the agent connects as cannot do the thing you are afraid of.

That arrangement is most of what production readiness means for a codebase an agent wrote, and it is the first thing we separate when taking a Claude Code project to production. The tooling will keep producing CVEs. The separations are what make each one an update rather than an incident.