Is Claude Code safe for the enterprise? What the official settings cover, and what they don't

Claude Code is only as safe as the environment around it. Its official settings are a useful floor that should be enabled on every fleet. However, many real deployments won’t be bulletproof because developers have local admin rights, multiple coding agents are in use, and so on. Many documented attacks work around these controls too.

Two things people mean by “Claude Code security”

“Claude Code Security”, capitalized, is a product. Anthropic released it in February 2026 to scan a codebase for vulnerabilities.

This article is about the other meaning: running the agent itself safely, the core of AI coding agent security. Claude Code reads repositories, runs shell commands and edits files with whatever privileges the developer has. Depending on configuration, it can perform destructive or malicious actions, as many recent incidents have shown. That’s why AppSec and security teams got a new job: making sure their enterprise Claude Code rollouts are safe.

What the official Claude Code security controls do well

Credit first, because the floor is higher than most teams realize.

Managed settings let an organization push a policy to every machine that no user, project or command line flag can override. The policy can turn off bypass permissions mode, restrict MCP servers and hooks to a managed allowlist, ignore permission rules from user and project files, disable auto mode, pin which models and which API providers a session may use, and refuse to start an outdated binary. On a managed fleet where developers lack admin rights, those are locks rather than suggestions.

The sandbox is the second piece. Since October 2025, Claude Code can run commands inside an OS level sandbox, bubblewrap on Linux and seatbelt on macOS, that confines writes to the working directory and routes network traffic through a proxy that asks before a new domain is reached. Anthropic reports that in its internal usage sandboxing cut permission prompts by 84%. The method isn’t described and the runtime is still labeled a research preview, but the direction is the right one: the safer configuration is also the one with fewer interruptions.

Then the data side. Traffic from users on commercial plans is not used for training. Zero data retention is available for Claude Code on Claude for Enterprise, enabled per organization after an eligibility check. Telemetry and error reports can be switched off and are off by default when Claude Code runs through Bedrock, Vertex or Foundry.

Switch all of that on. Everything below is about what it does not reach.

Claude Code risks the model layer can’t close

Permission prompts were the original control, and they failed in a way nobody designed around. Anthropic’s own number: users accept 93% of them. In a study of 1,053 paid developers that Simon Willison summarized in August, people refused a planted dangerous command 13.6% of the time. A prompt that gets approved nine times out of ten is a usability feature, which is roughly what the Cloud Security Alliance concluded about approval prompts in its GuardFall note.

Auto mode is the replacement. A classifier reads each action the agent proposes and approves the ones it judges safe, so the human is asked less often. Anthropic published the key number: a 17% false negative rate on real overeager actions, measured on 52 curated cases, which the post itself calls “the honest number”. The same post lists what overeager looks like. After an authentication error, the agent went through environment variables and config files looking for other tokens. After a failed deploy check, it retried with a skip verification flag. Asked to clean up old branches, it pattern matched and deleted remote ones. Anthropic’s own conclusion: auto mode “is not a drop-in replacement for careful human review on high-stakes infrastructure”.

Then it became the default. On August 14, 2026, auto mode switched on for Pro, Max and Team subscribers. On August 26, Johann Rehberger published a chain that planted a struct.py file to shadow a standard Python module. It succeeded in three of five trials in one variant and four of five in another, and Anthropic closed the report as informative. The CSA’s research note put it precisely: “A single headline percentage and a working, repeatable exploit chain can both be true simultaneously.”

One more data point, from a single informal test by a vendor. Told to find a way to run a command its denylist blocked, Claude Code found a path that dodged the pattern, hit the sandbox, then proposed disabling the sandbox and asked for approval to run the command unsandboxed. The agent is an optimizer whose job is to finish the task. A soft control is just another problem for it to solve.

None of this makes the model layer useless. It makes it probabilistic, and a probabilistic layer is not a true security control.

Risks not addressed by Claude Code security settings, according to Anthropic

The managed settings and authentication documentation, as of October 2026, lists the limits itself. The quotes below are from it.

Local admin

“A developer who is an administrator on the machine can edit the managed source itself”. Anthropic’s answer is to have MDM redeploy the file on a schedule. This narrows the window but doesn’t close it. If your developers have admin rights on their laptops (and most do), the managed policy is advisory.

One tool only

“Managed settings bind Claude Code only. A developer who calls the API from another tool isn’t under them”. Most estates run more than one agent. Uber, for one, supports Claude Code, Copilot, Codex and Cursor side by side. Each has its own policy model, so central enforcement is a per tool, per surface project, and the Claude Code policy says nothing about what Cursor may do on the same machine with the same credentials. Even if an organization blocks calls to non-Anthropic models and bans other harnesses, any employee can still set up a second Claude harness, such as Claude Desktop, with a personal API key, and that one is partly unmanaged.

Cloud sessions

“A session in an Anthropic-hosted environment doesn’t read a device’s MDM profile or file”. Policy for those has to come from server managed settings, a different mechanism with different coverage.

Server side settings alone are not enforcement

For the list of allowed API providers, the docs are direct: a list set only in server managed settings “reaches only sessions that fetch your organization’s settings, so treat it as a convenience for machines you can’t reach with device management, not as enforcement”.

Some login paths escape the organization lock

The claude setup-token command and the GitHub app installer enforce only the login method, “so they can mint a token in a different organization”. The interactive login screen preselects the required method “without enforcing it”.

Long sessions lag

A session left open for weeks can keep running under the policy it started with. The setting that blocks an outdated binary from starting “doesn’t end a session that’s already running”.

Transcripts live on disk

Session transcripts are stored locally in plaintext for 30 days by default, and anything sent through the feedback commands is kept for five years. Neither is covered by the zero data retention you negotiated for the API.

Rules judge actions, not outcomes

Native controls are strict rules. They allow or forbid a concrete action without asking what it does or where a chain of actions leads. A drifting agent, or a destructive command a user issued by mistake, passes every policy as long as it touches only what the user normally touches.

Agents work around fixed rules

Block one command and the agent reaches for an equivalent: another binary, another flag, another interpreter. The vendor test above caught Claude Code dodging its own denylist. Every new rule invites a new workaround, and defenders end up playing whack-a-mole.

Attackers do it on purpose

What an agent stumbles into, an attacker engineers: shell tricks, symlinks, and more. The next section walks through the documented cases.

Read together, these limits form a clear pattern. The settings are strongest where enterprises are already strong: managed devices, no admin rights, one tool, interactive sessions. Developer laptops with admin rights, several agents, CI runners and cloud sessions are much less protected. Unsurprisingly, these setups dominate at smaller and less regulated businesses, and most documented incidents happened in exactly such relaxed environments.

Known attacks against Claude Code vs. built-in security controls

The published attacks are not model failures. Almost every one sits in the harness, the software shell around the model that loads config, runs tools and draws the approval prompts. Our own count of the ten best documented attacks on Claude Code found two that produced CVEs and four that carry a vendor declination.

Researchers found that Claude Code read project level configuration before the startup trust dialog resolved, so cloning and opening a repository could run shell commands and exfiltrate API keys. That pair, CVE-2025-59536 and CVE-2026-21852, was fixed. It is the only entry on the list where Anthropic acknowledged the bug with a CVE against Claude Code itself.

TrustFall showed that accepting the folder trust prompt lets a project’s own MCP configuration spawn native processes outside the sandbox. Anthropic declined the report as outside its threat model, on the grounds that trusting the folder is consent to the project’s configuration. The dialog does not say so. The disagreement stands, and the behavior is still live.

The deny rules bypass has the most awkward cause. Claude Code stopped evaluating deny rules on commands with more than about fifty subcommands, because the check cost too many tokens. “Never curl” became “curl, given a long enough command line”. A fix appears to have landed in version 2.1.90, though we know this only from the changelog, and no CVE was assigned.

SymJack and GhostApproval both attack the approval prompt itself: the prompt shows one target and the agent writes to another, through a symlink or a misdescribed path. Anthropic added warnings for sensitive directories after SymJack and rejected GhostApproval as outside its current threat model. AWS and Cursor issued CVEs for the same bug class.

Then the supply chain found the agents. The Miasma worm in June 2026 planted hooks in the config directories of Claude Code, Cursor, Gemini CLI and VS Code that ran when a project was opened. It disabled 73 Microsoft repositories before it was contained, and no CVE exists because none of the code was defective. In March 2026, Claude Code, running with permissions skipped, upgraded to a trojaned LiteLLM release without a human running the install. In one account, endpoint behavior detection caught it. Nothing in the agent did.

The official settings would have blocked some of it on a locked fleet, but they would stop neither the attacks on the approval prompt nor the deny rule bypass. And anything in headless CI flies past most of the security controls Anthropic ships.

Note, too, that what caught attacks in the wild sat outside the agent: a disposable environment, an endpoint sensor, a scoped credential.

Claude Code security best practices: controls that hold regardless of settings

The overview above helps decide which settings to enable. The more important question is what the environment guarantees if every setting fails. Four of the controls below shrink what an agent can reach. One watches what it does with the rest.

1. The agent holds no credential that can do lasting damage. A local agent inherits the developer’s SSH keys, cloud tokens and registry credentials. Every well known destructive incident in this class ran through a credential the agent should never have held, whatever the model intended. Inject credentials through a proxy or issue them short lived and scoped to the task, give the agent its own identity where the tooling allows, and run one test this week: can any credential within the agent’s reach destroy both the data and its backups?

2. Egress is denied by default. CVE-2026-21852 exfiltrated API keys by pointing the agent at an attacker’s endpoint. The sandbox proxy that asks before a new domain is reached is the right shape. Make it the fleet default, keep the allowlist short, and remember that an allowlisted domain becomes an exfiltration route the moment it accepts arbitrary uploads.

3. Config and docs are code. Rules files, settings, hooks, skills, plugin manifests and MCP configs execute. Treat them as dependencies with owners and review, use the managed only locks where the fleet supports them, and watch config directories for writes by anything other than a person.

4. Someone watches what the agent actually does. Most of the attacks above beat a check that judged intent: a command pattern, an approval dialog, a classifier’s guess. Each step looked routine on its own. The chain did not: a secret read, then an upload; a write that lands outside the project through a symlink; a hook appearing in a config directory. Watch every action, connect the steps into one chain, and block it before the last step lands. That is how the trojaned LiteLLM upgrade was caught. Cover every agent your developers run, because the managed policy binds only Claude Code, and keep the record off the machine: the default transcript sits in the user’s home directory for 30 days and may be gone before the review. This is the job of a coding agent security platform. The test: if an agent read a production secret and sent it out tonight, who would know, and when?

5. Unattended work runs in a disposable room. Auto mode, background runs and CI agents belong in a container, a VM or a cloud runner with no production data and no open internet. Miasma and the Check Point bug both detonate at project open, before anyone reads a line of source, and a rebuilt image is the whole cost. The organizations running the most agent output work this way, and they run those agents without permission checks for exactly that reason: a room that holds nothing valuable needs no prompts. Since October 21, the room has an open source implementation: NVIDIA’s OpenShell runs Claude Code in a kernel isolated Linux sandbox with egress denied by default and credentials substituted outside the agent’s reach. That covers the CLI in a sandbox, but still not the laptop a developer uses all day.

FAQ

Is Claude Code safe to use at work?

Claude Code’s official settings help, but only as a floor. Admin laptops, other agents and CI runs largely escape them, as do attacks on the approval prompt and deny rules.

Does Claude Code send our code to Anthropic?

Prompts and outputs go to the model provider you configure. Commercial plans are not used for training, and standard retention is 30 days unless zero data retention has been enabled for your organization, which is a separate eligibility step on Claude for Enterprise. Transcripts also sit in plaintext on the developer’s machine for 30 days by default, and anything sent through the feedback commands is kept for five years.

Can managed settings be bypassed?

On a device where the developer has local admin rights, yes. Anthropic’s documentation says the developer can edit the managed source itself. On a device without admin rights and with MDM delivery, the locks hold for Claude Code. They do not bind any other agent on the same machine.

Is auto mode safe?

Safe enough for work inside a disposable environment with no credentials worth stealing. Anthropic reports a 17% miss rate on real overeager actions, and a published bypass succeeded in most trials. Outside the room, keep the human in the loop.

What does Claude Code Security do?

It is Anthropic’s code scanning feature, released in February 2026, that finds vulnerabilities in a codebase. It says nothing about whether the agent is running safely. This article is about the agent.