AI Coding Tool MCP Config Workspace Trust Bypass (CVE-2025-59536, CVE-2025-54136)

Ibrahim Saud@tektrix

•updated Jun 27, 2026•1•0•2

Detects instances where code editors like Cursor or Claude execute shell commands or CLI tools often used for configuration, network activity, or credential interaction. This pattern may indicate malicious exploitation of editor configuration files (e.g., MCP configuration) or unauthorized use of the editor environment to execute shell commands.