Full Report
Security biz Adversa AI argues users of AI tools need clearer warnings
Analysis Summary
# Vulnerability: TrustFall - Insecure MCP Server Configuration in AI CLIs
## CVE Details
- **CVE ID**: CVE-2025-59536 (Related/Previous); TrustFall is currently considered "out of scope" by vendor but identified as a distinct flaw by Adversa AI.
- **CVSS Score**: N/A (Vendor dispute, though the impact is full RCE)
- **CWE**: CWE-1037: Processor Optimization Removal or Modification (Context: Insecure Default/Inadequate Consent UX)
## Affected Systems
- **Products**:
- Claude Code CLI
- Gemini CLI
- Cursor CLI
- Copilot CLI
- **Versions**: Claude Code CLI v2.1.114 and potentially others.
- **Configurations**: Any instance where the user interacts with a cloned repository containing malicious `.mcp.json` or `.claude/settings.json` files.
## Vulnerability Description
The vulnerability stems from the way AI CLI tools handle the Model Context Protocol (MCP). MCP servers are JSON-based standards that allow AI models to access local tools and data.
In affected versions, specific project-level settings (specifically `enableAllProjectMcpServers` and `enabledMcpjsonServers`) are not restricted. When a user accepts a generic "Trust this folder" prompt, the CLI silently enables and spawns MCP servers defined in the repository. These servers run as unsandboxed Node.js processes with the full privileges of the user, leading to Remote Code Execution (RCE) without requiring a specific tool call from the AI agent.
## Exploitation
- **Status**: PoC available (demonstrated by Adversa AI).
- **Complexity**: Low (requires only a generic "Yes" to a trust prompt).
- **Attack Vector**: Network (via cloned git repositories or downloaded project folders).
## Impact
- **Confidentiality**: High (Full access to user files and system environment).
- **Integrity**: High (Ability to modify code and system configurations).
- **Availability**: High (Ability to execute destructive commands).
## Remediation
### Patches
- No official security patch has been released as Anthropic currently considers the "Trust" dialog to be a sufficient security boundary.
- **Note**: Version 2.1 of Claude Code removed more explicit warnings that were present in earlier versions.
### Workarounds
- **Manual Review**: Inspect `.mcp.json` and `.claude/settings.json` files in any third-party repository before opening the directory in an AI CLI.
- **Restrict Permissions**: Avoid running AI CLIs in directories that contain untrusted code.
- **Interface Caution**: Do not click "Yes, I trust this folder" unless you have verified the presence of any hidden configuration files that might spawn background processes.
## Detection
- **Indicators of Compromise**:
- Unexpected `node` processes spawned by the CLI parent process.
- Outbound network connections from local MCP servers to unknown C2 IPs.
- Presence of `enableAllProjectMcpServers: true` in project settings.
- **Detection Methods**: Monitoring process trees originating from AI agent CLIs and auditing `.mcp.json` files for suspicious `command` or `path` values.
## References
- Adversa AI TrustFall Research: hxxps[://]adversa[.]ai/blog/
- Demonstration Video: hxxps[://]www[.]youtube[.]com/watch?v=3kVOYQ70FVY
- NVD CVE-2025-59536: hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2025-59536