exposing all parent process secrets (GITHUB_TOKEN, GEMINI_API_KEY) and bypassing four defensive layers. The same pre-task execution pattern appeared in Claude Code (execution before the trust dialog) and Codex (MCP auto-launch before the model), revealing a shared architectural blind spot: workspace configuration influences process authority before model-time guardrails activate. The exploit required no prompt injection—three lines in a configuration file were sufficient for