# trustfall-one-click-rce-via-claude-code-trust-dialog-regression: TrustFall: One-Click RCE via Claude Code Trust-Dialog Regression

> TrustFall: One-Click RCE via Claude Code Trust-Dialog Regression is a high-severity remote code execution issue in Claude Code, a CI integration. Affected: Claude Code (trust-dialog regression), Cursor, Gemini CLI, GitHub Copilot (June 2026).

- **Canonical URL:** https://catalog.anomity.ai/vuln/trustfall-one-click-rce-via-claude-code-trust-dialog-regression
- **Aliases:** ti-033
- **Severity:** high
- **Attack type:** Remote code execution
- **Component:** Claude Code (CI integration)
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-06-01
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/trustfall-one-click-rce-via-claude-code-trust-dialog-regression

## Summary

Adversa AI disclosed TrustFall, a regression in Claude Code's trust dialog combined with a settings-scope inconsistency that lets a cloned repository execute unsandboxed code with minimal interaction, a single keypress locally and zero interaction on CI runners. The confirmed one-click RCE reaches Claude Code, Cursor, Gemini CLI, and GitHub Copilot, underscoring how implicit trust assumptions in agent settings keep resurfacing across vendors.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| Claude Code (trust-dialog regression), Cursor, Gemini CLI, GitHub Copilot (June 2026) | no fixed version listed |

## Am I affected by this vulnerability?

You are affected if you run Claude Code (trust-dialog regression), Cursor, Gemini CLI, GitHub Copilot (June 2026).

## How do I fix it?

Disable auto-trust of cloned repositories; require explicit per-repo trust. Run agents non-interactively only in sandboxed CI with no host credentials. Update Claude Code to the post-regression release. Audit CI runners for unexpected code execution since late May.

## References

- article: https://adversa.ai/blog/top-agentic-ai-security-resources-june-2026/

## Related vulnerabilities

- [plugin4shell-sha-pinning-bypass-gives-zero-click-rce-across-claude-code](https://catalog.anomity.ai/vuln/plugin4shell-sha-pinning-bypass-gives-zero-click-rce-across-claude-code) — critical
- [CVE-2025-59536](https://catalog.anomity.ai/vuln/cve-2025-59536) — critical
- [a-repo-defined-claude-code-subagent-downgraded-its-own-security-review](https://catalog.anomity.ai/vuln/a-repo-defined-claude-code-subagent-downgraded-its-own-security-review) — medium
- [CVE-2026-54316](https://catalog.anomity.ai/vuln/cve-2026-54316) — high
- [claude-code-silently-patched-five-permission-and-hook-bypasses-across-2](https://catalog.anomity.ai/vuln/claude-code-silently-patched-five-permission-and-hook-bypasses-across-2) — high
- [CVE-2026-46406](https://catalog.anomity.ai/vuln/cve-2026-46406) — medium

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=trustfall-one-click-rce-via-claude-code-trust-dialog-regression