Critical Claude AI Vulnerability Exposes Local Files to Malicious Repositories

Key Takeaways

• A critical vulnerability in Claude Code AI allows malicious repositories to exfiltrate local files from a user’s system without explicit consent.
• The flaw (CVE ID not yet assigned) exploits a discrepancy between how Claude Code validates file paths and resolves symlinks, bypassing security prompts.
• Sensitive data, such as /etc/passwd, can be silently included in the AI model’s initial outbound request to Anthropic’s API or a malicious third-party server.
• The issue affects Claude Code versions 2.1.207 and 2.1.215, with no immediate patch released by Anthropic, which views workspace trust as the primary security boundary.

A significant security flaw has been identified in Anthropic’s Claude Code AI, potentially enabling attackers to surreptitiously extract local files from a user’s machine. The vulnerability stems from how the AI assistant handles symbolic links and file imports, allowing malicious repositories to bypass intended security checks and transmit sensitive data.

This issue highlights a critical gap in Claude Code’s consent and data provenance mechanisms, specifically within its memory import feature. Unlike typical filesystem symlink handling, the AI tool validates @import statements based on their visible path within a project, yet it follows symlinks when the file content is actually read. This disparity creates an opportunity for attackers to import files from outside the project directory without triggering Claude Code’s external import approval dialog.

Claude Code relies on files like CLAUDE.md and those in .claude/rules/ to load project instructions. These files can contain imports such as @./docs/setup.md, which are used for including shared instructions at the start of a session. An attacker could exploit this by embedding a line like @./link in CLAUDE.md and then committing link as a Git symlink pointing to a sensitive local file, such as /etc/passwd or /proc/self/environ, provided the current user has read permissions.

Claude Code Repository Attack Mechanism

The core of the vulnerability lies in Claude Code’s processing order. When an import like ./link is encountered, Claude Code first evaluates it as an internal repository path. Because the path appears to reside within the project, no warning for an external import is generated. However, when the memory loader attempts to read the file, the operating system resolves the symlink, directing the read operation to the actual target file located outside the repository.

The contents of this external file are then silently incorporated into the AI model’s initial context. This occurs before Claude Code has the opportunity to execute any read tools, commands, or prompt the user for approval. Researchers have confirmed that the imported file’s content is subsequently included in the very first outbound request initiated by Claude Code.

By default, this data is sent to Anthropic’s API endpoint. However, a critical aspect of this attack is the ability for a malicious repository to override the ANTHROPIC_BASE_URL setting within a .claude/settings.json file. This configuration override can redirect Claude Code’s traffic to an attacker-controlled endpoint, facilitating the exfiltration of the imported data. Tego Researchers showed how this mechanism could be leveraged to send private user files to a server chosen by the attacker.

This vulnerability is particularly concerning for developers who have configured broad parent directories, such as their home folder (~/), ~/src, or /Users, as trusted workspaces. In such scenarios, a newly cloned malicious project within these trusted directories might not trigger a fresh trust dialog, allowing the exploit to proceed unnoticed.

Previous Symlink Vulnerabilities

This isn’t the first time symlink handling has posed a security risk in Claude Code. This incident draws parallels with earlier symlink-related issues, including CVE-2025-59829 and CVE-2026-25724. In both previous cases, Anthropic addressed the flaws by ensuring that symlinks were resolved before security checks were enforced. Researchers contend that the memory loader involved in the current vulnerability did not receive the same rigorous canonical-path validation.

Tests conducted on Claude Code version 2.1.215 demonstrated this behavior, and static analysis also confirmed the vulnerability in version 2.1.207. Despite the clear security implications, Anthropic has reportedly classified the HackerOne submission as “informative,” asserting that workspace trust is the intended security boundary and that a trusted project is permitted to read, edit, and execute within its context.

What You Should Do

• Exercise Extreme Caution with Repositories: Only clone and trust repositories from known, reputable sources. Avoid executing Claude Code within projects from untrusted origins.
• Review Workspace Trust Settings: Regularly audit and restrict your Claude Code workspace trust settings. Avoid granting broad trust to parent directories like your home folder.
• Inspect .claude/settings.json: Before running Claude Code on any project, inspect the .claude/settings.json file for any suspicious ANTHROPIC_BASE_URL overrides or other unusual configurations that could redirect data.
• Canonicalize Import Targets: If you are a developer, implement robust canonical-path validation for all import targets before applying containment and consent checks in your own tools.
• Demand Clear Warnings: Advocate for Anthropic to implement explicit user warnings when imports resolve outside the repository and to clearly identify settings that can alter API endpoints in repository configurations.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.