TrustFall: One-Click RCE via Claude Code Trust-Dialog Regression
TrustFall: One-Click RCE via Claude Code Trust-Dialog Regression is a high-severity remote code execution issue in Claude Code, a CI integration. Affected: Claude Code (trust-dialog regression), Cursor, Gemini CLI, GitHub Copilot (June 2026).
Is Claude Code running on your developers' machines? Anomity inventories the AI agents, MCP servers, extensions and skills on every developer device, so you can see what this advisory touches. Detect this across your developers' devices with Anomity →
Key facts
- ID
trustfall-one-click-rce-via-claude-code-trust-dialog-regression- Severity
- high
- Attack type
- Remote code execution
- Component
- Claude Code · CI integration
- Known exploited
- No known exploitation
- Published
- Last verified
What is this vulnerability?
Adversa AI disclosed TrustFall, a regression in Claude Code's trust dialog combined with a settings-scope inconsistency that lets a cloned repository execute unsandboxed code with minimal interaction, a single keypress locally and zero interaction on CI runners. The confirmed one-click RCE reaches Claude Code, Cursor, Gemini CLI, and GitHub Copilot, underscoring how implicit trust assumptions in agent settings keep resurfacing across vendors.
Affected versions
| Affected | Fixed in |
|---|---|
Claude Code (trust-dialog regression), Cursor, Gemini CLI, GitHub Copilot (June 2026) | No fixed version listed |
Am I affected by this vulnerability?
You are affected if you run Claude Code (trust-dialog regression), Cursor, Gemini CLI, GitHub Copilot (June 2026).
How do I fix it?
Disable auto-trust of cloned repositories; require explicit per-repo trust. Run agents non-interactively only in sandboxed CI with no host credentials. Update Claude Code to the post-regression release. Audit CI runners for unexpected code execution since late May.