Preliminary research
Approve Once, Exploit Forever: The Trust Persistence Problem in Claude Code, Codex and Gemini-CLI
Approve Once, Exploit Forever: The Trust Persistence Problem in AI Coding Agents
AI-collected research leads through 2 October 2026, including bounded month-by-month reviews of selected social and community sources from April through September. Unranked, incomplete, not community-vetted, and subject to change.
Claude Code, Codex and Gemini CLI persist trust for a project path even after executable MCP or agent configuration changes. Once a directory is approved, later repository content can silently replace commands or servers and gain code execution when the project is reopened.
Record
- Document
- Approve Once, Exploit Forever: The Trust Persistence Problem in AI Coding Agents
- Researcher
- Piotr Ryciak
- Published by
- Mindgard
- Date
In the archive
Related sources
- Patterns Repository
Tags
This page is the archive's own catalogue record. The research is the work of Piotr Ryciak, first published at the original source. Preserved copies are kept so the citation survives its host.