# Workspace config auto-executes with inherited credentials

Config files in cloned repos that spawn processes or enable shell on open, using ambient credentials

_Area: AI and LLM app security. Seen in 2 disclosed reports; latest 2026-09-04. Updated 2026-10-24._

## How it works
AI coding tools treat config files inside a workspace as trusted settings. When a user clones and opens a repo, the tool reads those files and acts on them: it may spawn MCP server processes [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-amazon-q-vulnerability.md) or enable a shell-execution tool [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-gx45-xrj5-g6c4.md). The action happens on folder open, with no consent prompt and no workspace-trust check. The spawned process or tool inherits the full user environment, including cloud credentials. The broken assumption is that anything inside a workspace is safe to execute, and that a config file is data rather than code.

## Where it shows up
- Dotfolders in a repo root that define servers or tools: `.amazonq/`, `.cursor/`, `.claude/`, `.codewhale/` [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-amazon-q-vulnerability.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-gx45-xrj5-g6c4.md)
- Config keys that turn on execution: MCP server command definitions, `allow_shell`, exec-tool enablement [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-amazon-q-vulnerability.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-gx45-xrj5-g6c4.md)
- Config merge code that copies project-scope values into session config
- Child processes spawned from config without a scrubbed environment
- Any load path that runs before a trust or consent dialog

## How to review
Find every config key that can cause execution or widen permissions. For each, check two things: is it on a deny-list for project scope, and does the merge enforce tightening-only (project config may restrict, never relax)? [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-gx45-xrj5-g6c4.md) shows sibling keys `approval_policy` and `sandbox_mode` guarded while `allow_shell` was copied unconditionally and missing from the deny-list. Then check the spawn path: does opening a folder trigger it, is there a consent or trust gate, and does the child inherit credentials? The invariant: untrusted workspace config must never execute or widen permissions without explicit user consent, and spawned processes must not inherit ambient secrets.

## Variants seen
- Extension auto-loads MCP config and spawns servers with inherited AWS credentials on folder open [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-amazon-q-vulnerability.md)
- Project TOML overrides a shell-enable flag, bypassing tightening-only merge guards [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-gx45-xrj5-g6c4.md)
- Payload delivered through a poisoned AI conversation, pasted as a shell one-liner that Gatekeeper does not inspect [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-amos-stealer-chatgpt-grok-ai-trust.md)

## Why fixes fail
[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-gx45-xrj5-g6c4.md) shows the failure mode directly: guards applied to some security keys but not all siblings in the same trust boundary. A fix that patches one key leaves the next one open.

## Impact and severity
High: command execution with the developer's cloud credentials, reachable by cloning a repo [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-amazon-q-vulnerability.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-gx45-xrj5-g6c4.md). Worse when execution is silent on open, credentials are broad, and no trust prompt exists. [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-amos-stealer-chatgpt-grok-ai-trust.md) shows the human-trust variant: no installer artifact, so detection must look at shell and browser history.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-amazon-q-vulnerability.md
- E2: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-amos-stealer-chatgpt-grok-ai-trust.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-gx45-xrj5-g6c4.md