One click to RCE: ~12,520 exposed MCP servers and a symlink trick that owns six major coding agents

This is the one that should make you check your own setup tonight. June MCP-security roundups flag roughly 12,520 internet-exposed MCP services, about 40% of them with no authentication at all. On top of that, Adversa AI's TrustFall and SymJack research shows that Claude Code, Cursor, Gemini CLI, Copilot CLI, Grok Build, and OpenAI Codex CLI can auto-execute project-defined MCP servers, or overwrite their own config, the moment a developer accepts a folder-trust prompt. That's remote code execution with full user privileges. Source: Adversa AI / Help Net Security

This was the second-strongest convergence in today's data. The same core finding surfaced from four separate researchers. The symlink-disguised-file-copy variant that tricks all six tools into RCE showed up again from the rss feed. Source: Adversa AI The throughline is uncomfortable and specific: the approval prompt you click does not reflect what actually gets executed. You think you're trusting a folder. You're trusting whatever that folder's config tells the agent to run.

I want to push on the popular assumption here, because it's wrong. A lot of people, me included until recently, treated the permission prompts in these tools as a meaningful gate. "It'll ask before it does anything dangerous." TrustFall shows the gap between what the prompt says and what runs. Folder trust is transitive in ways the UI doesn't surface. Clone a repo, open it in your agent, accept the trust prompt because you always do, and a malicious .mcp config or a symlinked path executes before you've read a line of code.

This connects straight back to the top of the issue. We're handing agents more authority every week. Claude writes the code, agents run the company, and the same agents have filesystem access and a one-click path to RCE. The capability and the attack surface are growing on the same curve.

What to do, concretely. Sandbox your coding agent. Run it in a container or a VM, not on your host with your SSH keys and cloud creds sitting right there. Require auth on any remote MCP server you stand up, because ~40% of the ones already exposed don't have it. Before you open an unfamiliar repo in Cursor or Claude Code, look at its MCP config the boring way, in your editor, not by accepting a trust prompt. And if you ship your own MCP servers, run a taint-style scanner against them first. VIPER-MCP already demonstrated automated taint analysis plus prompt-fuzzing driving real exploits across ~40K MCP repos. The attackers have the tooling. You should too.