The technique relies on a symbolic link placed inside an otherwise ordinary software repository. When combined with instructions in a CLAUDE. md file, the link can direct Claude Code towards sensitive material elsewhere on the developer’s computer and include that information in the first request transmitted by the tool.
The process may occur without a file-access alert, tool-execution notification or separate approval prompt clearly telling the user that data outside the cloned project is being read. The researcher who disclosed the issue said it had been confirmed against Claude Code versions in the 2.1. x series.
Claude Code is Anthropic’s command-line programming assistant. It can examine codebases, modify files, execute commands and interact with development tools through natural-language instructions. Its growing use among developers and enterprises has placed greater attention on how it handles untrusted repositories, project configuration files and local credentials.
The attack begins when a developer clones a repository controlled or modified by an attacker. The repository contains a project instruction file using Claude Code’s supported import syntax. Instead of pointing directly to another document, the instruction refers to a symbolic link that appears to remain within the project directory.
The operating system resolves that link to a file elsewhere on the machine. Potential targets could include configuration files, environment data, service credentials, source-code secrets or other information readable by the developer’s account.
Claude Code then loads the material as project context. Because the contents form part of the prompt sent for AI processing, the information leaves the local computer in the outbound model request. The weakness does not require the model to follow a malicious instruction, execute code or make an autonomous decision.
The problem centres on a mismatch between the path checked by the security mechanism and the path ultimately followed by the filesystem. Claude Code examines the apparent location of the link inside the repository, while the operating system reads the external destination to which it points.
Symbolic-link vulnerabilities are a long-established class of software weakness. They become more consequential in agentic coding tools because such applications routinely combine broad local access with network communication, automated context collection and permission to perform development tasks.
Anthropic’s documentation confirms that CLAUDE. md files can import other files and that Claude Code uses internet connectivity for authentication and AI processing. The product also supports additional working directories and configurable permission modes for reading, editing and executing content.
Tego AI, the Tel Aviv cybersecurity company that identified the behaviour, submitted the finding to Anthropic through the HackerOne disclosure programme in July. Anthropic classified the report as informative rather than treating it as a vulnerability requiring a security fix.
The company’s position was that the “trust this folder” prompt forms the relevant security boundary. Once a user approves a repository, Claude Code may receive wide authority to read, edit and execute files connected to the development environment.
Tego AI argued that the approval does not adequately distinguish between legitimate project operations and access to unrelated data. Developers often approve repositories before inspecting every file, while organisations may inherit trust settings from parent directories or use preconfigured development images.
The risk is especially significant in continuous-integration runners, containers and standardised corporate workstations. Such systems often store tokens, deployment credentials and configuration data in predictable locations. An attacker would not need to know the contents beforehand, provided the targeted file exists and is readable.
The researchers also documented a separate configuration behaviour through which a repository-level settings file could redirect Claude Code’s outbound connection towards an endpoint chosen by the repository author. Combined with the symbolic-link technique, that could provide a more direct route for collecting exposed data.
Claude Code has faced comparable path-handling problems before. Two earlier vulnerabilities involved checks being performed on one path while the filesystem resolved another. Those issues, identified as CVE-2025-59829 and CVE-2026-25724, were addressed in the product’s permission subsystem.
The newly disclosed behaviour was found in the startup memory loader, a separate code path that processes project instructions before the model begins taking actions. This distinction matters because the data can enter an outbound request before the permission system displays the prompts users normally associate with file operations.
The disclosure was Tego AI’s second finding involving the Claude ecosystem within a week. Its previous research examined the Claude integration for Slack and whether ordinary messages containing an “@Claude” reference could influence the assistant without sufficiently clear authorisation boundaries.
Security scrutiny of AI coding agents is intensifying as the tools gain access to source repositories, terminals, cloud platforms and internal documentation. Academic testing has found that malicious instructions can penetrate layers of protection in widely used coding agents, while independent assessments have questioned whether permission controls consistently identify risky actions.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
