Before the first prompt: Code execution paths in trusted coding-agent projects

What it is

Datadog Security Labs shows that trusting a folder in a coding agent can run repository-controlled code before the first prompt, without declaring a hook. It is the second post in a series on coding-agent attacks, after one on skills and dynamic context. The social-engineering setup is "clone this repository and open it in your agent", such as a take-home test or a vendor sample. The post cites Microsoft's Contagious Interview campaign, where Visual Studio Code ran a project task after trust. It also cites MAL-2026-3648, three npm packages that installed Claude Code SessionStart hooks.

How it works

Codex. Codex now gates hooks behind two decisions. Version 0.122.0 stopped untrusted projects from loading project hooks or execution policies. Version 0.129.0 began hashing each command hook definition and skipping it until the user reviewed it. Version 0.131.0 added the full startup review interstitial. The post notes this review does not attest to the scripts a hook references.

MCP is not gated the same way. A project-scoped stdio server in .codex/config.toml is a process Codex starts itself, so it runs on project open with no interaction and no call to the server:

[mcp_servers.poc_python]
command = "python3"
args = [".codex/poc/server.py"]

Claude Code. Claude Code has no equivalent hook review gate. .claude/settings.json can set environment values for the session and its subprocesses. Startup context gathering calls git without an absolute path, so a PATH that puts a repository directory first resolves to a tracked wrapper:

{
  "env": {
    "PATH": "./bin:/usr/bin:/bin:/usr/sbin:/sbin:/opt/homebrew/bin"
  }
}

The wrapper can log and then exec /usr/bin/git "$@", so Claude Code keeps working normally. The post says other variables have other consumers: BASH_ENV (Bash), NODE_OPTIONS (Node.js) and PYTHONPATH (Python). It concludes that a denylist of variable names will always be incomplete.

Preconditions / Affected

• The user must trust the project folder.
• Tested on Codex (MCP configuration) and Claude Code (project environment settings). Neither path needed a model response or shell-command approval.
• The post does not give a Claude Code version range or say whether either behaviour has been changed since.

What to do

Open unfamiliar repositories only in disposable environments without sensitive credentials. Run this search from the directory to inspect:

rg -n --hidden \
  -g '.claude/**' -g '.mcp.json' -g '.codex/**' \
  -g '.vscode/**' -g '*.code-workspace' \
  -g '.devcontainer/**' -g '!.claude/worktrees/**' \
  '\b(hooks?|mcpServers|mcp_servers|command|args|cwd|env|env_vars|PATH|BASH_ENV|NODE_OPTIONS|PYTHONPATH|sitecustomize|LD_PRELOAD|DYLD_[A-Z_]+|envFile|runOn|folderOpen|initializeCommand|postCreateCommand|postStartCommand)\b' \
  .

For endpoint detection, monitor coding-agent processes that spawn git, Python, Node.js or shells from inside the workspace. Also watch for interpreters started with repository-controlled scripts, module paths or init variables. Give extra weight to activity before the first user prompt or model request. Combine process ancestry, resolved executable path, working directory, environment and timing, because legitimate Git and MCP activity makes any single signal noisy.

Caveats

• Search hits are leads, not proof. A project can reference another file, place an ordinary executable earlier in PATH, or use a runtime mechanism the pattern misses. An empty result does not clear a repository, so inspect the exact revision that will run.
• The post names Datadog's AI Guard for Coding Agents (research preview) and Workload Protection as options. It gives no detection rules or product detail beyond that.