Research
Before the first prompt: Code execution paths in trusted coding-agent projects | Datadog Security Labs
Publication date not yet evaluated · Added datadoghq.com
Page published
Coverage timeline
Single-source research — one report is available.
Why it matters
Coding-agent users who assume that only malicious hooks or skills are dangerous can be silently compromised through MCP config and environment-based execution paths that run merely by opening a trusted repository, making project trust equivalent to running untrusted code.
Datadog Security Labs demonstrates that trusting a repository in coding agents such as OpenAI Codex and Claude Code can trigger repository-controlled code execution before the first prompt, without a model response or shell-command approval. In Codex, project-scoped MCP configurations start an attacker-controlled process, and in Claude Code a project-controlled PATH causes Claude's automatic Git probes to run a tracked repository wrapper — bypassing hook-approval controls.