🇬🇧The Register - AI/ML•Feb 26, 2026Stalecollected in 28m

Claude Code Flaws Enable Remote Code Execution

Post LinkedIn

🇬🇧Read original on The Register - AI/ML

#rce #api-theft #vuln-patchclaude-codeanthropic claude

💡Claude Code RCE vuln via tainted repos stole API keys—patched, but AI dev tools risky.

⚡ 30-Second TL;DR

What Changed

Vulnerabilities in Claude Code enabled remote code execution

Why It Matters

Exposes risks in AI coding collaboration tools, potentially compromising developer environments and sensitive keys. Users must vet repositories carefully. Highlights ongoing security challenges in AI-assisted development.

What To Do Next

Audit repositories for malicious configs before cloning into Claude Code.

Who should care:Developers & AI Engineers

Key Points

•Vulnerabilities in Claude Code enabled remote code execution
•Malicious configs injected into repositories for attacks
•API keys stolen when devs clone and open projects
•Anthropic patched the specific flaws
•AI collaboration tools retain broader attack surfaces

🧠 Deep Insight

Background and context from public sources — not the original article. 7 sources cited.

🔑 Enhanced Key Takeaways

•Vulnerabilities specifically exploited Hooks in .claude/settings.json, Model Context Protocol (MCP) servers, and environment variables to execute shell commands[1][3].
•Check Point Research disclosed the issues and collaborated with Anthropic for remediation, with patches applied before public publication[1].
•Anthropic implemented an enhanced warning dialog for untrusted configurations and plans additional granular risk controls[1].
•Attackers could leverage stolen API keys for billing fraud or accessing Workspaces to manipulate shared projects and data[1][3].

🛠️ Technical Deep Dive

•CVE-2025-59536 and CVE-2026-21852: No user consent bypass via untrusted .claude/settings.json hooks enabling arbitrary code execution (fixed in v1.0.87, Sep 2025; CVSS 8.7)[1][3].
•CVE-2026-21852: Info disclosure in project-load flow by setting ANTHROPIC_BASE_URL to attacker endpoint, leaking API keys pre-trust prompt (fixed in v2.0.65, Jan 2026; CVSS 5.3)[3].
•CVE-2026-25722: Path traversal via cd commands bypassing write protections in .claude directory for file tampering (affected <v2.0.57; published 2026-02-06)[2].

🔮 Future ImplicationsAI analysis grounded in cited sources

AI coding tools will require mandatory trust prompts for all project configs

Anthropic's enhanced warning dialog and planned granular controls set a precedent to mitigate untrusted repo risks before execution[1].

Stolen AI API keys enable Workspace access for deeper infrastructure compromise

Exfiltration allows attackers to modify cloud data, upload malware, or incur costs, expanding beyond billing fraud[1][3].

Vulnerability disclosure timelines will shorten due to AI-speed discovery

Anthropic's 90-day policy underscores the gap between AI finding bugs and patching, as seen in their 500 zero-days[4][6].

⏳ Timeline

2025-09

No CVE hook vulnerability fixed in Claude Code v1.0.87

2026-01

CVE-2026-21852 API key exfiltration fixed in v2.0.65

2026-02-06

CVE-2026-25722 path traversal published to NVD

2026-02-09

CVE-2026-25722 last updated in NVD

2026-02

Check Point discloses RCE flaws (CVE-2025-59536, CVE-2026-21852); Anthropic patches

2026-02-05

Claude Opus 4.6 research reveals 500+ zero-days; Claude Code Security preview launched

📎 Sources (7)

Factual claims are grounded in the sources below. Forward-looking analysis is AI-generated interpretation.

🇬🇧Read original article on The Register - AI/ML

📰

Weekly AI Recap

Read this week's curated digest of top AI events →

👉Related Updates

Same topic

Explore #rce

Same product