Top 10 attacks on Claude Code and what each one actually broke

Between September 2025 and September 2026, researchers published ten documented attacks on Claude Code, and at least one criminal campaign used it as a delivery mechanism. Almost none of these Claude Code vulnerabilities are model behavior. The attacks land on the machinery around the model: config files, hook definitions, approval dialogs, MCP tool descriptions, plugin pins, skill packages. Every file and every message that reaches the agent before a human looks at it is a source of danger.

Why Claude Code vulnerabilities don’t look like software vulnerabilities

A normal vulnerability is code doing something its author did not intend. Most of this list is code doing exactly what its author wrote, in a situation the author did not picture.

Claude Code reads three categories of attacker-reachable input without a human in the loop. Project configuration comes first: .claude/settings.json, .mcp.json, hook definitions, plugin pins. All of it ships inside the repository, all of it is authored by whoever controls that repository, and some of it executes at session start. Second is tool output, meaning whatever an MCP server hands back, which the agent consumes as trusted context. Third is the extension surface, skills and plugins pulled from marketplaces.

Every one of those is a place where a repository author, a marketplace publisher or an anonymous stranger on the internet writes something the agent treats as instruction or configuration. The only boundary in front of them is a trust dialog that offers two options, appears once, and appears before the user has read anything.

This is the structural shape of AI coding agent security as a whole, not a quirk of one product. For the non-attack version of the same gap, where agents deleted data without anyone attacking them, see our nine coding agent incidents that ended with deleted data.

Top 10 attacks on Claude Code

The ten at a glance

The Miasma worm weaponizes Claude Code against Microsoft

On June 5, 2026 a compromised contributor account pushed a commit to Azure/durabletask that planted configuration files executing a credential harvesting payload the moment a developer opened the repository in Claude Code, Gemini CLI, Cursor or VS Code. For Claude Code the trigger was a .claude/settings.json SessionStart hook. GitHub disabled 73 repositories across four Microsoft organizations in a 105-second automated sweep, taking Azure/functions-action down and breaking CI/CD pipelines globally.

Supply chain defense for the last decade has been built around package install: lockfiles, install script blocking, provenance, SBOMs. Miasma moved the detonation point to project open, which happens before any of that runs and is not a moment most teams have instrumented. That shift in timing is the thing to take from this one.

Zero CVEs exist for any artifact in the campaign, because none of the code was defective. SafeDep covers the config injection mechanics, and The Hacker News has the wider campaign.

TrustFall turns one keypress into unsandboxed code execution

Adversa AI showed that all four major agentic CLIs start MCP servers defined inside a project once the user accepts the folder trust prompt. Those servers run as native OS processes, outside any sandbox, carrying the user’s full privileges. No tool call and no suspicious model output, just a config file and a dialog that defaults to yes.

The fully unattended variant, running through the official GitHub Action with no human in the session at all, was demonstrated on Claude Code specifically.

Anthropic declined the report as outside their threat model, on the grounds that accepting the folder trust prompt constitutes consent to the project configuration. Adversa’s counter is that the v2.1 and later dialog never tells users that trusting a folder can spawn arbitrary native processes, so the consent is not informed. Both positions are coherent. Neither produced a patch, which is why this one is still live in every deployment reading this sentence. Dark Reading covered the disagreement.

A malicious repo runs shell commands before you trust it

Check Point Research found that Claude Code read project-level configuration from .claude/settings.json before the startup trust dialog resolved, so cloning and opening an untrusted repository could execute arbitrary shell commands and exfiltrate Anthropic API keys through hooks, MCP servers and environment variables.

CVE-2025-59536, CVSS 8.7, CWE-94, covers the code injection and was fixed in 1.0.111. CVE-2026-21852 covers the key theft, achieved with a settings file pointing ANTHROPIC_BASE_URL at an attacker endpoint, and was fixed in 2.0.65. Both were patched before publication. It is the strongest entry on this list, and the only one carrying a CVE pair that Anthropic acknowledged against Claude Code itself.

The trust dialog was the control designed to stop exactly this, and the config it was gating had already been read by the time the user saw it.

Agentjacking turns a fake bug report into a shell command

A Sentry DSN is public by design and sits in frontend JavaScript. Tenet Security used that to POST fabricated error events into real projects, formatted to mimic Sentry’s own MCP output templates, with a ## Resolution section containing an npx command.

The attack sits at the intersection of two reasonable designs. Sentry’s ingestion accepts arbitrary payloads from anyone holding the DSN, because that is what error reporting requires. The Sentry MCP server hands that data to agents as tool output, which agents treat as trusted, because that is what tool output normally is.

A developer asks Claude Code to fix unresolved Sentry issues, which is an ordinary Tuesday request, and the agent runs the attacker’s command with the developer’s privileges. Tenet reported an 85% success rate across Claude Code, Cursor and Codex, and identified 2,388 organizations whose DSNs accepted injected events. Sentry acknowledged the report and declined a structural fix. No CVE. The New Stack has the Sentry side of the exchange.

Deny rules stop working at the 51st subcommand

Adversa found that Claude Code’s permission system capped its analysis at 50 subcommands for performance reasons, and above that cap it skipped deny rule enforcement entirely. A developer who configures “never run rm” sees it blocked when it appears alone, and sees it run unrestricted when it arrives preceded by 50 harmless statements. The delivery vehicle is a poisoned CLAUDE.md carrying a realistic 50-step build process with the payload sitting at position 51. Evidence for the cap is a code comment and a UI freeze ticket, so the motivation was performance rather than anything more interesting.

A correct tree-sitter parser already existed in the codebase and checked deny rules before falling back. It was never enabled in the shipping path. That is the detail that made this one sting.

A fix landed in Claude Code v2.1.90, though the changelog entry that lines up with it describes a change to the PowerShell tool rather than the deny path, so the mapping from report to patch is inferred rather than stated. Keep this separate from CVE-2026-35020, 35021 and 35022, which are command injection findings, were assigned by VulnCheck rather than Anthropic, and are flagged as disputed in OSV.

SymJack: you approve a file copy, you get a config hijack

A repository ships a symlink with an innocuous name whose target is the agent’s own config file. The approval prompt shows the decoy path. The kernel follows the link. Attacker-controlled JSON lands in .claude/settings.json or .mcp.json, and on the next restart the planted MCP server runs as the user.

Adversa confirmed working exploits in Claude Code, Gemini CLI, Cursor Agent CLI, GitHub Copilot CLI, Grok Build CLI and Codex Agent. Six agents, one primitive, and the primitive is older than every one of them.

This is the rare case where Anthropic moved without calling it a vulnerability. Security warnings were added to Claude Code’s approval flow for sensitive directories after the report, while other vendors declined it or ruled it out of scope. No CVE. See Adversa’s write-up and SecurityWeek.

GhostApproval: the agent knows the real target and shows you a different one

Wiz tested six coding assistants and found the same trust boundary gap in all of them. Claude Code’s variant is the most uncomfortable to read, because the failure is not in the filesystem logic at all. The agent’s internal reasoning stated that the file was a zsh configuration file. The prompt shown to the user asked only whether to make an edit to project_settings.json. The agent knew. The user didn’t.

Wiz sorted the six into tiers and put Claude Code and Google Antigravity in the deceptive UI group, distinct from Amazon Q and Windsurf, which wrote to disk before the user could accept or reject at all. AWS shipped CVE-2026-12958 and Cursor shipped CVE-2026-50549.

Anthropic rejected the finding as outside its current threat model, arguing that users accept the risk once they trust a directory and approve a prompt inside it. Read that against the reasoning trace and the argument gets harder: the risk a user accepts is presumably the risk they were shown.

Plugin4Shell: the pinned commit that isn’t the commit

SHA pinning is the industry’s answer to plugin rug pulls. Review the code at one commit, pin that commit, trust it forever. AIR Security found that Claude Code checks out the pinned SHA but never verifies the checkout landed there.

In git, a 40-character hex string can name a commit object or equally name a branch, and when both exist git resolves the reference first. An attacker controlling a plugin repo creates a branch named exactly like the pinned SHA, makes it the default branch, and owns the working tree while the agent reports a clean install at the expected hash.

What makes it zero-click is auto-update, on by default in Claude Code. The same checkout re-runs in the background, so a marketplace SHA bump pushes the swap to plugins the user already reviewed and already trusts.

One caveat belongs in the entry. The branch-name trick only works where a host allows branch names that look like hashes, and GitHub rejects 40-hex branch names outright, so real exposure was Bitbucket and self-hosted marketplaces. Anthropic’s own docs list both as valid backends. Patched in 2.1.179, roughly three months before publication, with no CVE assigned and no in-the-wild exploitation reported. Help Net Security has the summary.

ToolLeak turns the agent’s own tool arguments into an exfiltration channel

An academic team ran the first systematic red team of six coding agents and found that an attacker-registered MCP tool can define an argument that the agent fills with its own system prompt during ordinary argument generation. No jailbreak, no adversarial phrasing. The agent leaks by doing its job correctly.

Phase two chains that into execution using a two-channel injection split across the tool description and the tool return value. The method succeeded on 19 of 25 agent and LLM pairs, achieved leakage on every agent running a Claude or Grok backend, and obtained RCE on every tested pair. The paper includes a dedicated Claude Code case study.

It removes the last comfortable assumption about MCP: that a malicious server has to do something visibly malicious. Here the server just declares a schema. The paper is arXiv

SkillCloak hides a malicious skill from every scanner that checks it

Skill scanners are the main defense at install time for the Agent Skills ecosystem, and this paper argues the defense is structurally bypassable. Self-extracting packing moves the payload outside the scanner’s observable scope, into an ignored directory or an encoded blob, and reassembles it at execution time. Evasion approached total across every scanner surveyed.

The evasion figure describes scanners, not Claude Code. The study covered eight scanners and two production agents, Codex and Claude Code, using 1,613 in-the-wild malicious skills. Claude Code is the execution host here, not the defective component, and nobody has caught attackers using these exact packing tricks at scale. The Hacker News covered it without that distinction, so read the two together.

Static analysis of a skill package cannot tell you what that package will assemble at runtime. That is a ceiling, not a bug, and if your skill governance ends at the scanner, it ends before the interesting part.

Why only two of these got a CVE

Two entries on this list produced CVEs. Check Point’s pair is the only one filed against Claude Code itself; Wiz’s GhostApproval work produced CVEs at AWS and Cursor, but not at Anthropic. Anthropic declined TrustFall and GhostApproval as outside its threat model. Sentry declined a structural fix for Agentjacking. SymJack got security warnings in the approval flow but no vulnerability designation. Plugin4Shell and the deny rule cap were patched quietly with no CVE, and two entries are academic papers with no vendor process attached at all.

So of ten working attacks, your vulnerability scanner sees two, your SBOM sees none, and your patch management program can act on three.

None of that is bad faith on anyone’s part. The vendor position is internally consistent: if the product’s documented security model says the trust prompt is the boundary, then an attack that requires the user to cross that boundary is not a product defect. The researchers are equally consistent in reply, and the reply is that users cannot make an informed decision about a dialog that does not describe what it authorizes.

Which one you find persuasive does not change your exposure. Whoever is right, the behavior runs in your environment tomorrow morning. A finding marked “declined, working as intended” is not less exploitable than a finding marked CVE-2025-59536. It is only less tracked. If your AI risk register is populated from CVE feeds, it currently holds two of these ten, and it is missing both of the ones with a demonstrated success rate against unmodified production setups.

That is the part to take to your next risk review.

How to secure Claude Code deployments

Start from the assumption that a repository, a plugin, a skill or an MCP server will eventually hand your agent an instruction it should not follow, and design so that instruction cannot reach anything that matters.

Build the layer yourself

Treat project configuration as executable code, because it is. .claude/settings.json, .mcp.json, hook definitions and plugin pins deserve the review you give a Dockerfile or a CI workflow, and they deserve it before the repository is opened rather than after. Four of the ten attacks above live in these files. Add them to your code review checklist and to your pre-commit tooling.

Open unknown repositories somewhere disposable. Miasma and CVE-2025-59536 both detonate at project open, before a human reads a line of source. A container or a VM where the worst case is a rebuilt image turns both into nothing.

Stop treating approval prompts as an integrity control. SymJack and GhostApproval both show the displayed text diverging from the operation performed, and in GhostApproval’s case the agent’s own reasoning already held the real answer. If a prompt string is the only thing standing between an agent and your dotfiles, a display bug is now a privilege escalation.

Pin plugins to a marketplace you control, and review the auto-update setting. Plugin4Shell’s zero-click property comes from background auto-update re-running the checkout. The patch is in 2.1.179, but the lesson outlives it: trust decisions made at install time need re-verification at execution.

Give the agent its own identity and its own credentials. CVE-2026-21852 exfiltrated Anthropic API keys through a redirected ANTHROPIC_BASE_URL. Short-lived tokens, a separate service identity and no ambient developer permissions cap what any of these attacks can reach.

Treat MCP output as untrusted input, at the same level as an HTTP response body. Agentjacking and ToolLeak both come through a trusted channel carrying attacker-authored content. Channel trust is not content trust.

Don’t let skill governance end at the scanner. SkillCloak’s finding is that static analysis cannot see what a package assembles at runtime, which moves the observation point to runtime whether you planned for that or not. Our skill scanner bypass survey shows the same results.

And take the patches. Three entries here are fixed in shipping versions, and a fixed vulnerability in an unpatched deployment is an unfixed vulnerability.

Or buy the layer, with the security rules written out of the box

That is what Adversa AI builds. Our coding agent security platform watches the agent’s own traffic and connects the chain of agentic actions: what untrusted content entered the session, which files and secrets were touched, where data went, what command was sent. Those signals live in separate domains, and the platform is where they meet, matching the agent’s stated reasoning against the shell commands and MCP calls it issued. Which is the exact gap GhostApproval documented.

100+ attack-anchored policies ship by default, covering prompt injection and malicious context, config and hook tampering, and the tool output paths that Agentjacking and ToolLeak use. Unambiguous attacks are blocked, ambiguous ones pause for confirmation, and every action is recorded for audit. It deploys as an Agent Security Gateway, optionally with an Endpoint Security Sensor that monitors what coding agents do on developer machines, which is where the config file attacks land. Typical checks run under a millisecond and the design fails open, so a platform outage never blocks a developer.

For more research in this area, follow our agentic AI security coverage. For the wider pattern across the whole AI stack, our Top AI Security Incidents report collects the cases beyond coding agents.

Nearly every attack on this list works because something told the user one story while doing another. You cannot fix that from inside the thing telling the story. Stop the damage, not the developers.