TrustFall — one "trust this folder" click hands attacker MCP servers full developer privileges across Claude Code, Cursor, Gemini CLI, and Copilot

Trust persists across sessions. On the next tool invocation, the MCP server starts automatically. No malware binary required — the tool provides the execution environment. Developer credentials, SSH keys, and cloud tokens are accessible to the server process.

In automated environments, trust prompts are suppressed by design. A contributor role or compromised PR is sufficient. The audit log records a standard pipeline run. Access to the runner’s secret store is access to the production environment and the software supply chain.

No direct access to the target organization required. Widely forked starter templates, framework scaffolds, and shared tooling repos are all delivery vectors. The MCP config file is small, visually unremarkable, and not typically covered by existing dependency audit tooling.

TrustFall — MCP server auto-execution in trusted AI coding tool folders across Claude Code, Cursor, Gemini CLI, and Copilot (Adversa AI, May 7, 2026)
Attacker-controlled MCP servers in cloned repos execute as OS processes on trust designation. Zero interaction in CI/CD environments. Anthropic characterised it as outside current threat model; no architectural patch forthcoming.

Audit repo MCP configs; block auto-execution in CI/CD; require code review for config file changes
Ask: do any pipelines run AI coding tools with access to production secrets? If the answer is not immediately known, that is the gap to close this week.

AI-assisted exploit development — first documented AI-authored zero-day in the wild — 2FA bypass assessed with high confidence to be LLM-generated, intended for mass exploitation (Google GTIG, May 11, 2026)
AI-written exploit identified by GTIG before mass campaign launched. AI-authored telltales present: hallucinated CVSS scores, educational docstrings, and textbook Pythonic structure. (Lead story, Issue #043.)

Compress patch window targets; treat unpatched public-facing services as higher-risk
AI exploit development compresses time between disclosure and weaponized exploit. The safe window after patch publication is shorter. Prioritise emergency patching of exposed web-facing services.

Linux “Copy Fail” CVE-2026-31431 — CISA KEV, local privilege escalation to root on Linux kernels since 2017 (KEV added May 1, 2026)
Privilege escalation via a flaw in the kernel crypto subsystem enables local root; exploitation requires an authenticated local user account. Ubuntu, RHEL, Amazon Linux 2023, SUSE 16 affected. Containers and cloud VMs on affected kernels are in scope. (First covered pre-KEV in Issue #034.)

Apply kernel patches via distribution security channel now; confirm cloud VM and container host kernels are updated
Confirm with your infrastructure team that managed Kubernetes node pools and cloud AMIs have received the updated kernel. CISA KEV addition confirms active exploitation.

Canvas LMS breach — ShinyHunters, 275 million records across approximately 8,800 institutions (per ShinyHunters’ claims), multiple named Canadian universities; PIPEDA breach notification obligations triggered (May 3–7, 2026)
Names, email addresses, student numbers, and personal messages exposed. No passwords, financial data, or government IDs confirmed compromised. (Lead story, Issue #042.)

Complete PIPEDA significant-harm assessment if not already done; assess provincial FIPPA/FOIP obligations in parallel
Canadian institutions affected should be actively assessing breach notification obligations. The Canada Angle section of this issue covers the PIPEDA accountability framework.

Cisco Catalyst SD-WAN CVE-2026-20182 — CVSS 10.0, CISA KEV, unauthenticated high-privileged access (discovered by Rapid7)
Unauthenticated attacker gains high-privileged access to SD-WAN controllers via crafted requests in the peering authentication mechanism. Wide enterprise and telecom deployment. (CVE Watch, Issue #043.)

Patch SD-WAN controllers immediately if not already done; review SD-WAN management interface logs for anomalous authentication patterns
CVSS 10.0 with confirmed active exploitation: treat as a fire drill if unpatched.

OSFI Guideline E-23, effective May 1, 2027, requires federally regulated financial institutions to implement formal model risk management across their model inventory. E-23 takes a risk-based approach: models assessed as negligible risk may qualify for exemption from full lifecycle governance, but AI and ML models operating in development pipelines are unlikely to qualify. AI coding tools generating code deployed to regulated systems, or operating with pipeline access to financial infrastructure, fall within that scope. The MRM framework E-23 requires — model identification, risk tiering, validation, change management, and ongoing monitoring — applies to AI coding tools operating with elevated development pipeline privileges.

The advisory: Document TrustFall exposure and your organizational mitigations in your AI model risk inventory now. “We identified this risk and applied these controls” is a stronger E-23 compliance posture than discovering the gap during a 2027 examination. Q3 2026 is the practical documentation start date for FRFIs that have not yet begun MRM programme buildout.

Primary source: OSFI Guideline E-23 (effective May 1, 2027) →

Following the Canvas LMS breach covered in Issue #042, PIPEDA’s mandatory breach notification provisions apply to the multiple named Canadian universities. When a breach involves personal information and poses a real risk of significant harm, organizations must report to the Office of the Privacy Commissioner and notify affected individuals directly — both as soon as feasible. Names, email addresses, student numbers, and personal messages, in combination, can meet the significant harm threshold. Separately, Ontario’s FIPPA, BC’s FIPPA, and Alberta’s FOIP impose parallel obligations on provincial public bodies, each with its own notification standard. Institutions operating across provinces must assess each jurisdiction independently.

The advisory: “As soon as feasible” under PIPEDA means promptly after the threshold determination is made — not after all uncertainty resolves. If a formal significant-harm assessment has not been completed, it is overdue.

Primary sources: PIPEDA — Office of the Privacy Commissioner → · Ontario FIPPA →

Bill C-26, the Critical Cyber Systems Protection Act, died on the Order Paper when Parliament prorogued in January 2025. The cybersecurity provisions were reintroduced as Bill C-8 in June 2025. Bill C-8 passed Third Reading in the House of Commons on March 26, 2026 and is currently before the Senate. It has not yet received Royal Assent as of May 17, 2026. What is in force is CCCS guidance requiring critical infrastructure operators in the finance, telecom, energy, and transportation sectors to manage supply chain security risk. TrustFall is a supply chain attack surface in the software development toolchain: a compromised CI/CD pipeline signing key is a supply chain compromise of every software artefact that key certifies.

The advisory: Critical infrastructure operators should assess TrustFall under their existing supply chain risk management programmes now. The CCCS supply chain security guidance is in effect and TrustFall falls directly within its scope — Bill C-8’s passage would add mandatory reporting obligations on top of what CCCS already expects.

Primary sources: Bill C-8 Legislative Status (Parliament of Canada) → · CCCS Supply Chain Security Guidance →

HARDENED is published for general informational and educational purposes. All threat data is sourced from publicly available security research and cited accordingly. This newsletter does not constitute professional security advice. Security configurations and threat landscapes vary by organisation. Consult a qualified security professional for implementation guidance specific to your environment. All data as of May 18, 2026. HARDENED does not endorse or recommend specific vendors. Tools are listed for awareness only.

How we work: HARDENED uses AI agents for research, drafting, and automation. Every issue is reviewed by humans before publication. If you spot an error, reply directly — we correct the record promptly.

hardened.news