Loading story…
Check Point researchers disclosed critical security flaws in Claude Code, reporting that the issues could expose developers and organizations to remote code execution, sensitive data leakage, and broader compromise of development environments. The findings indicate that weaknesses in how the coding assistant handled untrusted content and tool interactions could let attackers manipulate outputs, trigger unsafe actions, or access information that should remain protected.
The disclosure places AI-assisted development tools under the same scrutiny long applied to major software supply-chain and application-security incidents such as Apache Log4j CVE-2021-44228, which became a benchmark for rapidly exploitable software flaws with wide downstream impact. The report underscores that coding assistants embedded in developer workflows can become high-value targets, and that organizations using them should review trust boundaries, sandboxing, secret handling, and monitoring around automated code-generation and execution features.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Check Point published research describing critical security flaws affecting Claude Code. No earlier or more specific event date is provided in the content, so the publication date is used as the estimated date.
Docker's reference concerns the critical Apache Log4j 2 vulnerability CVE-2021-44228, indicating public disclosure of the flaw by early January 2022. With no additional event details provided in the content, the publication date is used as the fallback estimate.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Check Point Research** disclosed multiple critical vulnerabilities in Anthropic’s *Claude Code* AI coding assistant that could allow **remote code execution** and **credential theft** when a developer clones and opens an **untrusted repository**. The reported attack path abuses repository-controlled configuration and automation features (including **Hooks**, **MCP servers**, and **environment variables**) to trigger hidden shell command execution and to exfiltrate **Anthropic API credentials**, potentially enabling a pivot from a developer workstation into broader enterprise environments where Claude-related workflows and shared resources are accessible. The issues include consent-bypass and command-execution weaknesses tracked under **CVE-2025-59536** (covering closely related flaws involving repository configuration executing commands without adequate user consent) and an API credential exposure issue tracked as **CVE-2026-21852**, which affected *Claude Code* versions prior to **2.0.65** and enabled API key theft via malicious project configurations. Anthropic has **patched** the vulnerabilities and advised users to update to the latest version, while indicating additional hardening measures are planned to reduce supply-chain risk from malicious commits and repository-level configuration abuse.
Jun 29, 2026
Security researchers disclosed multiple vulnerabilities in **Anthropic’s Claude Code** AI coding assistant that could enable **arbitrary command execution** and **exfiltration of Anthropic API credentials** when developers clone/open a malicious repository. Check Point Research reported the issues abuse Claude Code configuration and initialization paths—particularly **project hooks** (e.g., untrusted `.claude/settings.json`), **Model Context Protocol (MCP) servers**, and **environment variables**—to trigger shell command execution and data theft. Anthropic’s advisory for **CVE-2026-21852** describes a project-load flow where a crafted repo can set `ANTHROPIC_BASE_URL` to an attacker-controlled endpoint, causing Claude Code to send API requests **before** the trust prompt is shown, potentially leaking the user’s API key. The disclosed issues include two high-severity code-injection paths (CVSS **8.7**) and one information-disclosure flaw (CVSS **5.3**): a consent-bypass/hook-based injection issue fixed in *Claude Code* **1.0.87** (Sept 2025), **CVE-2025-59536** fixed in **1.0.111** (Oct 2025), and **CVE-2026-21852** fixed in **2.0.65** (Jan 2026). Separate coverage framed Anthropic-related developments as market-moving, noting investor attention around Anthropic’s AI code-security tooling; however, the actionable security impact in this reporting is the risk that simply opening an attacker-controlled repository can lead to **RCE** and **credential leakage**, reinforcing the need to treat untrusted repos and tool initialization behaviors as a supply-chain and developer-workstation risk.
Jun 29, 2026
Anthropic accidentally exposed roughly **512,000 lines** of production source code for **Claude Code**, and attackers quickly turned the leak into a lure for developers seeking “unlocked” or leaked versions of the tool. Researchers reported malicious GitHub repositories repackaging the exposed material and distributing ZIP archives containing a **Rust-based dropper** that installed **Vidar v18.7** information-stealing malware and **GhostSocks** proxy tooling. One malicious repository reportedly ranked prominently in Google search results for queries related to leaked Claude Code, increasing the chance that developers would download the payloads, while duplicate repositories under different GitHub accounts were linked to the same actor. The leak also created a broader security risk by exposing Claude Code’s internal architecture, including system prompt construction, tool definitions, safety boundaries, and anti-distillation mechanisms. Because Claude Code can access file systems, execute terminal commands, and modify development environments, researchers warned that disclosure of the full agentic harness gives adversaries a clearer path to craft prompt injections, evade protections, and audit the codebase for exploitable flaws. Those concerns intensified after a **critical vulnerability** in Claude Code was publicly reported within days of the source exposure, highlighting how the incident expanded the threat surface beyond malware delivery into direct exploitation of organizations using the tool.
Jun 29, 2026