Critical Vulnerabilities in Anthropic Claude Code Enable RCE and API Key Theft via Malicious Repositories

Check Point Research disclosed multiple critical vulnerabilities in Anthropic’s Claude Code AI coding assistant that could allow remote code execution and credential theft when a developer clones and opens an untrusted repository. The reported attack path abuses repository-controlled configuration and automation features (including Hooks, MCP servers, and environment variables) to trigger hidden shell command execution and to exfiltrate Anthropic API credentials, potentially enabling a pivot from a developer workstation into broader enterprise environments where Claude-related workflows and shared resources are accessible.

The issues include consent-bypass and command-execution weaknesses tracked under CVE-2025-59536 (covering closely related flaws involving repository configuration executing commands without adequate user consent) and an API credential exposure issue tracked as CVE-2026-21852, which affected Claude Code versions prior to 2.0.65 and enabled API key theft via malicious project configurations. Anthropic has patched the vulnerabilities and advised users to update to the latest version, while indicating additional hardening measures are planned to reduce supply-chain risk from malicious commits and repository-level configuration abuse.