Time Table

You clone a repo and open it in your AI coding agent. No prompt typed, no tool call approved — yet calc.exe is running, and so is the attacker’s shell.

Every AI coding agent ships a safety story: a “Trust this folder?” dialog, a permission prompt, a sandbox. Across Claude Code CLI, Cursor (IDE + CLI), and Gemini CLI, that story is mostly theater: attacker code runs from workspace-local config with full user privileges, before the trust gate, approval layer, and sandbox ever get a vote.

We call it pre-prompt RCE. Under a strict rule — open a folder, launch the agent, click “Trust” at most once — we show 20+ PoCs that pop calc.exe on Windows 11, two undocumented in Cursor CLI (the strongest fires before the Trust dialog appears). We classify primitives by final firing point, show how cross-vendor config loading turns one repo into a multi-agent weapon, and use Anthropic’s microVM-isolated Claude Desktop as the control proving the class is fixable. Live demo; coordinated disclosure.