AIコーディングエージェントの設定ファイル攻撃、ついに「ゼロクリック」になる（CVE-2026-30615） AIコーディングエージェントの設定ファイル攻撃、ついに「ゼロクリック」になる（CVE-2026-30615）

A new chapter in AI coding agent security has arrived with CVE-2026-30615, a vulnerability that enables zero-click exploitation through malicious repository configuration files — no user confirmation required. For a threat category that once depended on tricking developers into clicking "trust," this represents a fundamental shift in the attack surface.

Previous research, including the TrustFall and AWS Kiro findings, established that configuration-file attacks against AI coding agents were real but required multiple steps: a developer had to clone a malicious repository, open it in their editor, and then explicitly approve a trust dialog. That multi-step requirement gave defenders a meaningful chokepoint. CVE-2026-30615 collapses that window, suggesting that the agent may parse and act on configuration files before any user-facing prompt is shown — a design assumption that is now demonstrably dangerous.

The rapid adoption of the Model Context Protocol (MCP) amplifies the risk considerably. MCP connects AI agents to external tools and services, and those connections are typically configured through JSON or YAML files stored inside project repositories. As MCP-enabled workflows become the norm across tools like Claude Desktop, Cursor, and various IDE extensions, a single maliciously crafted config file can potentially redirect an agent's tool calls, exfiltrate context, or invoke unintended actions the moment a project is loaded.

The supply chain angle is particularly troubling. If a compromised npm or PyPI package modifies or injects a configuration file as part of its install routine, the attack is already complete before the developer ever consciously interacts with an AI agent. Combined with the broad codebase access that agents like GitHub Copilot Workspace or Cursor's composer feature routinely request, the blast radius of such an intrusion could extend well beyond a single file or session.

There is also a social-engineering dimension worth noting. Developers have grown accustomed to trusting repositories from familiar-looking sources — forks of popular projects, starter templates, or open-source scaffolding tools. The cognitive load required to scrutinize every configuration file in every dependency is unrealistic, which is precisely why zero-click vectors are so significant: they remove the moment of human judgment entirely.

Vendor responses and patch details remain partially unclear at the time of writing, but the architectural implication is straightforward: AI agents need integrity verification and sandboxed parsing of configuration files before any code path that could cause side effects is reached. A pre-execution confirmation step — or at minimum, a cryptographic check against a known-good manifest — would go a long way toward restoring the trust boundary that CVE-2026-30615 appears to eliminate.

For developers in the meantime, keeping AI coding tools updated is the most immediate mitigation available. Treating unfamiliar repositories with the same caution one would apply to running arbitrary scripts remains sound advice, even if that caution can no longer guarantee safety on its own. The broader lesson may be that as AI agents gain more ambient authority over development environments, the security models governing them need to mature at the same pace.