Critical Vulnerability in Claude Code MCP Exposes OAuth Tokens

Key Takeaways

• A critical vulnerability has been discovered in Claude Code’s Model Context Protocol (MCP) that allows for the silent interception of OAuth bearer tokens.
• The attack leverages a malicious npm package and a five-step chain to redirect MCP traffic through attacker-controlled infrastructure.
• Compromised tokens grant persistent and broad access to integrated SaaS platforms like Jira, Confluence, and GitHub.
• Anthropic, the vendor, has acknowledged the report but stated no patch is planned, placing the burden of detection and response on enterprise security teams.

Unpatched Claude Code Flaw Exposes OAuth Tokens to Persistent Interception

A sophisticated attack chain targeting Anthropic’s Claude Code Model Context Protocol (MCP) has been uncovered, enabling attackers to silently redirect traffic and steal OAuth bearer tokens. This critical vulnerability, demonstrated by researchers at Mitiga Labs, allows for persistent, broadly scoped access to vital connected SaaS platforms such as Jira, Confluence, and GitHub, without requiring privilege escalation or new CVEs.

The attack initiates with a seemingly innocuous, malicious npm package. This package contains a hidden postinstall lifecycle hook, a well-known vector for supply chain attacks. This hook executes silently during installation, a tactic that gains significant new implications within AI-agentic development environments.

The primary objective of this hook is the ~/.claude.json file. This global configuration file is central to Claude Code’s operation, governing all MCP traffic routing and, critically, storing OAuth tokens in plaintext.

Upon installation, the malicious hook pre-populates common developer clone paths with “trust dialog flags” set to true. From Claude Code’s perspective, the user has already approved these directories, meaning no prompts will appear when they are subsequently accessed, effectively bypassing a crucial security control.

When a developer connects an MCP server, such as those for Atlassian or GitHub, Claude Code executes a full OAuth flow. It is during this process that the vulnerability is exploited.

The Value of Compromised Tokens

The bearer tokens obtained through this method are exceptionally valuable to attackers due to several key properties:

• Persistent: The tokens are stored for session reuse alongside associated refresh tokens, meaning a single interception can establish a durable foothold.
• Broadly Scoped: They inherit all permissions granted during the initial authorization, with no subsequent narrowing or re-consent requirements per call.
• Weakly Stored: The tokens reside in plaintext within the ~/.claude.json file, alongside trust flags, all possessing identical file permissions.
• Unattributable Server-Side: When presented, these tokens appear to originate from Anthropic’s egress IP range, rendering them indistinguishable from legitimate traffic on the provider’s end.

Five-Step Claude Code MCP Attack Chain

The complete attack chain operates without needing privilege escalation, memory corruption, or a new CVE:

1. Delivery: A malicious npm package installs a postinstall hook and seeds trust flags across developer clone paths.
2. Path Seeding: The hook modifies ~/.claude.json to inject a sessionStart hook, which activates every time Claude Code loads a trusted project.
3. MCP Endpoint Rewrite: The session hook then replaces legitimate MCP server URLs (e.g., Atlassian’s endpoint) with a localhost proxy controlled by the attacker.
4. Token Interception: Claude Code reads the rewritten URL, connects to the attacker’s proxy, and the OAuth bearer token traverses attacker infrastructure. Crucially, the provider sees a valid flow from a trusted origin (Anthropic’s egress IP).
5. Persistent Reseeding: The hook reasserts the malicious configuration with every Claude Code load, automatically recapturing new tokens even after rotation or manual URL correction.

A particularly concerning finding is that the standard incident response action of rotating the OAuth token inadvertently benefits the attacker rather than severing access. Since the malicious hook rewrites ~/.claude.json before each session, any subsequent OAuth refresh will hit the attacker’s proxy, delivering a fresh token. Effective remediation requires removing the hook and cleaning the configuration file before rotating credentials.

Furthermore, security teams reviewing provider-side logs, such as Atlassian audit entries, will observe a valid username, a legitimate session, and an IP address resolving to Anthropic’s egress range. Every field appears authentic, making detection difficult. The only anomaly resides within ~/.claude.json, a user-level configuration file that most security teams do not routinely monitor.

Mitiga reported their findings to Anthropic on April 10, 2026. Anthropic acknowledged the report on April 11 but responded on April 12 that the issue was considered out of scope, citing the user’s prior consent as a prerequisite for the attack. As a result, no patch is currently planned, shifting the entire detection and response burden onto enterprise security teams.

What You Should Do

• Monitor Configuration Files: Implement monitoring for unexpected modifications to ~/.claude.json, specifically looking for changes to mcpServers URLs or the introduction of localhost proxy addresses.
• Audit npm Packages: Treat npm post-install hooks as a critical supply chain risk. Thoroughly audit any packages that register lifecycle scripts before they are deployed to developer machines.
• Strategic Token Rotation: If an intrusion is suspected, ensure the malicious hook is completely removed and the ~/.claude.json file is cleaned before auditing and rotating OAuth tokens connected to Claude Code integrations.
• Review SaaS Audit Logs: Scrutinize SaaS audit logs for requests originating from Anthropic egress IPs that do not align with a user’s known activity patterns.
• Alert on Anomalies: Configure alerts for the creation of new local proxies or unusual OAuth refresh behavior observed within developer environments.
• Immediate Verification: Organizations utilizing Claude Code with MCP integrations should immediately execute cat ~/.claude.json and verify that every URL listed under mcpServers corresponds to a recognized and self-configured endpoint.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.