Research · curated 4 Aug 2026
Before the first prompt: Code execution paths in trusted coding-agent projects | Datadog Security Labs
First reported datadoghq.com
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
Coding-agent users who assume that only malicious hooks or skills are dangerous can be silently compromised through MCP config and environment-based execution paths that run merely by opening a trusted repository, making project trust equivalent to running untrusted code.
Datadog Security Labs demonstrates that trusting a repository in coding agents such as OpenAI Codex and Claude Code can trigger repository-controlled code execution before the first prompt, without a model response or shell-command approval. In Codex, project-scoped MCP configurations start an attacker-controlled process, and in Claude Code a project-controlled PATH causes Claude's automatic Git probes to run a tracked repository wrapper — bypassing hook-approval controls.