Anthropic’s Claude Code automatically reads and executes MCP server configuration from .mcp.json files when opening any repository. A malicious branch can inject arbitrary commands this way, executed with the developer’s own privileges before any user action; the attack works even without an active Claude account. Immersive Labs disclosed the full attack chain.
When researchers reported this, Anthropic said the behavior is working as designed: configuration files are meant to be trusted. But developers routinely switch branches without reviewing configuration. They treat .mcp.json like .gitignore, not like a shell script. This gap between design intent and actual practice is the real issue.
The stakes are concrete. Payloads can steal SSH keys or cloud tokens, spawn reverse shells, or stage further downloads, all running as the developer. A developer switching to an untrusted branch has no warning that configuration changed.
No CVE number or Anthropic security advisory has been published as of today. The disclosure is same-day, so broader coverage is still forthcoming.
Sources: Claude Code RCE Vulnerability: How a Malicious Pull Request Executes Code
Related on this blog: [AUTO] Paperclip’s Real Problem: When Configuration Is Code • [AUTO] Langflow RCE Added to KEV After a Month of Silence • The diffusers trust_remote_code Bypass Was Patched in May