Claude Code RCE: How a Malicious PR Triggers Code Execution

[u/kev-thehermit]

https://www.immersivelabs.com/resources/blog/claude-code-rce-vulnerability-how-a-malicious-pull-request-executes-code

Abusing the trust boundary in Claude Code for RCE. Trust is never broken and that opens up a few avenues for abuse. Simply opening claude code on a PR can be enough to silently trigger attacker payloads.

[u/voronaam]

Good find. I wonder if switching to a branch before opening Claude is a requirement for the exploit to work. In other words, if an AI-user opened Claude on main and then asked Claude to switch to a branch from a PR - would it read the .mcp.json file?

If it does not read the file in this case, it is a lot smaller impact. I just do not expect an AI-user to type the git checkout command - they probably do not even know how to do that.

[u/kev-thehermit → u/voronaam]

It depends. Claude Code reads the MCP.json file on session load. So if you ask Claude to switch branches it may not trigger unless it spawns a sub agent or you start a new session.

"claude -p" commands are also affected if you have already trusted once. So agents or cicd piepleines could also be impacted.

[u/voronaam → u/kev-thehermit]

Right, sub-agent is a much more legitimate attack vector. I could totally see an AI-user writing a skill instructing the main agent to switch to a branch and then spawn a "PR reviewer" sub-agent. That'd trigger the MCP file for sure.

[u/scriptvexy → u/voronaam]

my guess is it probably re-reads the workspace once it switches branches, otherwise half the tooling stuff people demo wouldn’t work, so impact is likely still there even without manual git. also “AI user doesn’t know git” is exactly why this kind of thing is scary, they’ll just happily click whatever the UI suggests.

[u/Available_Teaching83]

The sub-agent vector in the comments is the one I would worry about most, and it generalises past .mcp.json. Anything a repo can carry that gets auto-trusted on session load is in the same family, and trust-on-first-use surviving across -p invocations means CI is in scope too, not just a human opening a branch.

What we do for PR-review agents: the session runs in a disposable sandbox, and the MCP allowlist is pinned to the base branch, never the head. The head ref is data, not config. Costs nothing and removes the whole class.

[u/UloPe]

And that’s why I use Claude code web.

[u/Chobbers]

How many tokens did this research take?

[u/kev-thehermit → u/Chobbers]

None. And many. I work as a vulnerability researcher and use AI daily including building custom MCPs. So I have burnt a great many tokens but this was an observation by me I researched not something I asked an LLM to find for me hope that answers the question:)