One keypress is all it takes to compromise four AI coding tools

**TrustFall research** shows that several AI coding CLIs (Anthropic Claude Code, Google Gemini CLI, Cursor CLI, GitHub Copilot CLI) can auto-start project-defined MCP helper programs when a developer accepts a default "trust this folder" prompt, enabling immediate execution of attacker-controlled code that can read SSH keys, cloud credentials, and exfiltrate data; a headless CI variant has no prompt and can be abused via malicious pull requests. The report includes a proof-of-concept exfiltration, notes enterprise mitigation via centrally managed settings (Managed scope) to disable project-scoped MCP auto-approval, and highlights disagreement with vendor messaging about whether prompts adequately disclose execution risk.