> ## Documentation Index
> Fetch the complete documentation index at: https://jonathansantilli-codegate-92.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Public evidence map

> Public incident patterns and CVEs that motivated CodeGate, mapped to the defensive capabilities that address each one.

This page summarizes public incident patterns that shaped CodeGate's detection design. Each incident group is mapped to the CodeGate capability families that address it.

## Evidence themes

The incidents below cluster around four recurring themes:

1. Repository files can become execution paths.
2. Consent and review controls can be bypassed or weakened.
3. MCP and tool metadata can carry malicious instructions.
4. Marketplace and extension supply chains can be compromised.

Most users install quickly and skip deep configuration review. They do not parse every hook, skill, extension manifest, or policy file before execution. CodeGate focuses on making these hidden control surfaces visible before launch.

## Incident groups

<AccordionGroup>
  <Accordion title="Project-file-driven command execution and secret exposure">
    **Public examples:** Check Point research on Claude Code and Codex CLI CVEs — CVE-2025-59536, CVE-2026-21852, CVE-2025-61260.

    **What happened:** Repository-controlled configuration files caused AI coding tools to execute commands or expose credentials without explicit user awareness. In several cases the behavior was described as "documented" yet was practically invisible to users who had not read deep configuration references.

    <Warning>
      CVE-2025-61260 (Codex CLI command injection) carries a CVSS score of 9.8. A repository-controlled file was sufficient to trigger shell command execution with no additional user interaction required.
    </Warning>

    **Why it matters:** Trusted repository files can trigger command paths users do not expect. When a project can place or modify MCP server definitions, hook scripts, or agent instruction files, those files become an attacker-controlled execution surface.

    **CodeGate capability families:**

    * Cross-tool discovery (Layer 1)
    * Command-surface detection: `COMMAND_EXEC`, `GIT_HOOK` findings (Layer 2)
    * Environment override detection: `ENV_OVERRIDE` findings (Layer 2)
    * Wrapper recheck: `codegate run` blocks launch if any config file changed since the scan
  </Accordion>

  <Accordion title="Consent bypass and unsafe auto-approval">
    **Public examples:** Cursor MCPoison research; AWS bulletin patterns on MCP approval flows.

    **What happened:** AI coding tool approval dialogs and MCP consent flows were found to be bypassable or reducible to "always allow" behavior through configuration or crafted prompts. Users who believed they were approving individual tool calls were in practice granting persistent approval.

    <Warning>
      CVE-2025-59536 (MCP consent bypass) demonstrates that the consent model users rely on to gate MCP execution can be circumvented. A project-controlled configuration can move the effective approval threshold from per-call to always-allow.
    </Warning>

    **Why it matters:** When consent mechanisms are weakened, the user's ability to review what an agent is about to do is removed. Users believe they are in control; in practice, execution has been pre-authorized.

    **CodeGate capability families:**

    * Consent-bypass detection: `CONSENT_BYPASS` findings (Layer 2)
    * Policy controls: `severity_threshold`, `blocked_commands`, `trusted_directories` config
    * Warning/threshold gating: `codegate run` requires confirmation for warning-level findings
  </Accordion>

  <Accordion title="MCP poisoning and cross-tool toxic flows">
    **Public examples:** Invariant Labs tool-poisoning research; toxic-flow analyses across multi-agent setups.

    **What happened:** Tool descriptions returned by MCP servers were found to contain hidden instructions that manipulated downstream agent behavior. In multi-agent setups, a compromised upstream tool could influence the behavior of other agents in the pipeline without the user being aware.

    **Why it matters:** Tool descriptions and upstream metadata can manipulate downstream agent behavior. The attack surface is not just what the user types—it includes every tool description the agent reads.

    **CodeGate capability families:**

    * Deep scan (Layer 3, opt-in): fetches remote tool descriptions for analysis
    * Tool-description analysis: detects hidden instructions in MCP tool metadata
    * `TOXIC_FLOW` findings: flags cross-tool manipulation patterns
    * Rug-pull tracking: `NEW_SERVER` and `CONFIG_CHANGE` findings detect server changes between scans
  </Accordion>

  <Accordion title="Malicious skill and rule content in public ecosystems">
    **Public examples:** Snyk ToxicSkills campaign and related disclosures.

    **What happened:** Publicly available skill and rule markdown files were found to contain high-impact payloads embedded in normal-looking instruction text. Users who installed these skills exposed their agents to adversarial behavioral instructions without any visible warning.

    **Why it matters:** Instruction files can hide high-impact payloads in normal markdown. Content that appears to be documentation to a human reader functions as an adversarial prompt when consumed by an agent.

    **CodeGate capability families:**

    * Rule/skill maliciousness detection: `RULE_INJECTION` findings (Layer 2)
    * Unicode analysis: detects hidden characters used for visual spoofing (bidirectional override, zero-width joiners)
    * Local text analysis (Layer 3, opt-in): text-only instruction-file analysis via supported meta-agent
    * Suspicious pattern heuristics across discovered markdown surfaces
  </Accordion>

  <Accordion title="Compromised marketplace and extension integrity">
    **Public examples:** Open VSX advisories; JFrog research on Amazon Q extension compromise.

    **What happened:** Extensions in established marketplaces were found to have been modified or replaced with versions containing malicious behavior. The trust signal users rely on—"this is in the official marketplace"—was not sufficient to guarantee integrity.

    **Why it matters:** Supply-chain trust can fail even in established ecosystems. Installation from a known source does not guarantee the installed artifact is safe.

    **CodeGate capability families:**

    * Plugin and extension provenance checks (Layer 1/2)
    * Signature and attestation policy controls
    * Transparency checks for extension manifests
  </Accordion>
</AccordionGroup>

## Scope and limits

CodeGate is an awareness and decision-support tool.

* It is not a complete prevention system.
* Detection quality depends on known patterns, configuration coverage, and available context.
* New attack techniques can appear before signatures and heuristics are updated.
* Deep analysis is opt-in and should be used with clear operator intent.

See the [Safety model and limits](/security/safety-model) page for a full description of what CodeGate does and does not claim.