The weakness affects the way Anthropic’s artificial intelligence coding assistant processes symbolic links while loading project instructions at startup. A malicious repository can contain a CLAUDE. md file that imports another file through a link appearing to remain within the project directory. The computer’s operating system can then resolve that link to a readable file elsewhere on the developer’s machine.
Potential targets include configuration files, source-code credentials, system information and other material accessible to the user running Claude Code. The imported content can be inserted into the coding assistant’s working context and included in its first request to Anthropic’s model infrastructure.
The reported attack does not require Claude Code to execute a command or ask permission to open the external file. It exploits an inconsistency between the path checked by the application and the destination ultimately resolved by the operating system.
A symbolic link is a filesystem object that redirects software from one path to another. Such links are widely used in development environments and are not inherently malicious. The security concern arises when an application verifies the visible path but fails to validate the final destination after the link has been resolved.
Researchers demonstrated the behaviour by placing an import instruction inside a committed CLAUDE. md file. That instruction referenced a symbolic link stored within the cloned repository, while the link pointed to a file beyond the project boundary. Claude Code accepted the apparent in-project path and loaded the external file through its startup memory mechanism.
The finding was tested against versions in the Claude Code 2.1 series. No evidence has been presented that the technique has been used in a large-scale attack, and exploitation requires a developer to obtain and trust a repository prepared by an attacker.
Anthropic reportedly classified the submitted vulnerability report as informational rather than accepting it as a separate security defect. Its position was that Claude Code’s “trust this folder” prompt establishes the principal security boundary and that approving a repository gives the tool broad access to project-controlled instructions.
Researchers disputed that interpretation. They argued that trusting a repository should not be treated as permission to read arbitrary files elsewhere on a workstation, particularly when users receive no notice identifying the external path or the information being uploaded.
The distinction is important because developers commonly clone unfamiliar repositories to inspect software, reproduce bugs or evaluate open-source packages. Many users may reasonably expect Claude Code’s project boundary and permission controls to prevent files outside that repository from entering an AI session automatically.
The disclosure follows earlier symlink-related weaknesses in Claude Code. CVE-2025-59829 involved bypassing file-access restrictions through symbolic links and was fixed in version 1.0.120. CVE-2026-25724 concerned another path-resolution weakness that could allow configured deny rules to be circumvented. Anthropic addressed that issue in Claude Code 2.1.7 and later versions.
A separate vulnerability, CVE-2026-39861, affected Claude Code releases before version 2.1.64. It allowed sandboxed processes to create links leading outside the workspace, after which an unsandboxed component could write to the external destination without the expected confirmation. The new disclosure concerns reading data during memory loading rather than writing through the sandbox.
The sequence highlights a wider problem facing agentic coding platforms. These tools do more than suggest code: they inspect repositories, read local files, execute commands and communicate with remote models. Controls designed around ordinary filesystem paths can fail when links, mount points or path aliases cause the operating system to reach a different location.
Persistent instruction files are also becoming an attractive supply-chain vector. Files such as CLAUDE. md and AGENTS. md are automatically consumed as trusted project context, allowing repository maintainers to shape an agent’s behaviour before a developer has examined every instruction.
Security teams are advising developers to inspect instruction files and symbolic links before launching coding agents in unfamiliar repositories. Running agents inside isolated containers or disposable virtual machines can reduce exposure, while tightly scoped credentials limit the damage if local data is accessed.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
