Date: 2026-07-15. Class: AI-agent repo-config trust (MCP-autostart / GhostApproval). Result: goose = WALK (explicit-invocation + security-mature). Banked the discriminator.
The continue RCE (cycle309) fired because continue AUTO-WALKED a repo-committed
.continue/mcpServers/*.json on repo OPEN and SPAWNED its command with NO consent gate. The
security boundary for this whole class is:
- AUTO-LOAD-ON-OPEN (repo/CWD config discovered + its extensions/commands spawned just because
you opened/pointed the agent at the folder, no user action naming it) = VULNERABLE (continue, the
Cursor/Claude-Code/Amazon-Q CVE family). This is the primitive to hunt.
- EXPLICIT-INVOCATION (the user must name+run the config, e.g. goose run --recipe NAME) =
consent-by-invocation = NOT the RCE. Discovery/listing of local configs (scan_directory_for_recipes
-> recipe list) is NOT execution.
agent / agent session (no config arg) auto-load a CWD/repo config and spawn its
servers/commands? grep the session/startup path for current_dir() + config-load + spawn. If the
only CWD uses are working-dir tracking/display and configs load via an explicit name arg -> WALK.permission_confirmation
system + a config security-scanner (goose: recipe-scanner + check_for_security_warnings +
secret_discovery) marks a security-MATURE agent -> this class walks.
goose has both -> WALK. continue had neither -> RCE.[[project_cycle309_continue_mcp_rce_2026_07_14]] (the auto-load RCE), the agent-mcp-security-audit skill (2-question MCP-autostart test). Remaining sweep-forward candidate: opencode.