Topic starter
04/06/2026 3:02 pm
TL;DR: A flaw in VS Code's MCP install dialog let a single click hide environment variables and headers, enabling remote code execution or silent session hijacking for AI tooling, according to Oasis Security's research. The issue shows that AI agent governance fails when install-time trust is assumed but never truly inspected.
Editorial analysis by NHI Mgmt Group, based on content published by Oasis Security: “Envade: One Click in VS Code, Full Shell for the Attacker”.
Key questions
Q: What breaks when an MCP install dialog hides persisted fields?
A: The approval boundary breaks because the user is asked to review one configuration while a different one is written to disk.
Q: Why do hidden headers in AI tooling create identity risk?
A: Because headers can carry the authentication context that tells a remote service who the tool is acting as.
Q: How should teams govern MCP servers that act on a user's behalf?
A: Treat them as delegated identities with explicit inventory, approval, and audit requirements.
Practitioner guidance
- Audit persisted MCP configuration fields Inspect workspace mcp.json files and installation flows for env, envFile, headers, and cwd values that were not intentionally set by the operator.
- Block approvals that hide execution inputs Require install previews to render every field that can affect process startup, request headers, or downstream authentication context.
- Inventory AI tooling credentials and principals Map which MCP servers, assistants, and agent-like tools hold credentials, which account they use upstream, and which systems they can reach.
Bottom line: The flaw is an identity boundary problem, not only a user-interface defect, because hidden configuration can change what principal a tool becomes at runtime.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
04/06/2026 3:16 pm
Install-time approval is no longer a reliable identity boundary for AI tooling: The article shows that a user can approve one visible configuration while a different, more powerful configuration is written behind the scenes. That breaks the assumption that the human reviewer sees the effective trust decision. For MCP and agentic workflows, the governance question is no longer who clicked Install, but whether the persisted identity state matches what was reviewed.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What is the difference between install-time review and runtime trust for agent tools?
A: Install-time review is the human approval of a package or configuration, while runtime trust is the actual behaviour once the tool starts using persisted settings. In agent tooling, those can diverge, so governance has to verify the effective configuration after persistence, not only the preview shown at install.
👉 Read our full editorial: VS Code MCP install dialog flaw exposes agent identity risk