Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-03-23 · source-backed
Check Point Research disclosed that Claude Code's .claude/settings.json hooks can be weaponized in untrusted repos to execute arbitrary shell commands and exfiltrate Anthropic API keys by redirecting ANTHROPIC_BASE_URL to an attacker-controlled MitM proxy (Check Point). Both CVEs are patched, but the pattern — project-level config files that execute before trust is granted — applies to any hook-enabled agentic IDE. Inspect .claude/ directories before opening untrusted repos.
Each link below shares sources, entities, or timing with this story.
The most important security research this week. Check Point demonstrated three attack vectors in Claude Code exploiting project configuration files in untrusted repositories: (1) Hooks RCE (CVE-2025-59536, CVSS 8.7) — malicious hooks in .claude/settings.json execute shell comm...
Check Point Research disclosed that ANTHROPIC_BASE_URL in a repository's .claude config can redirect all API traffic — including full authorization headers — to an attacker-controlled server before the user reads a trust dialog, exfiltrating API keys in plaintext. A second vec...
Three attack vectors: (1) Hooks-based RCE via .claude/settings.json executing shell commands on SessionStart without confirmation, (2) MCP consent bypass via repo-controlled config auto-approving all servers, (3) API key exfiltration via ANTHROPIC_BASE_URL pointing to attacker...
CVE-2025-59536 (CVSS 8.7): malicious hooks in a cloned repo's .claude/settings.json execute shell commands at session startup before security dialogs appear. MCP consent bypass: .mcp.json with enableAllProjectMcpServers auto-approves rogue servers. CVE-2026-21852 (CVSS 5.3): o...
Check Point Research disclosed CVE-2025-59536 and CVE-2026-21852 — two vulnerabilities that weaponize Claude Code's project configuration system against its users. This matters because an Agents Anonymous survey this week showed 90% of practitioners at their SF meetup use Clau...
Check Point's AI Security Report 2026 documents AI crossing from assistant to operator inside live intrusions. The attacker chained two commercial tools: Claude Code for intrusion and network exploration, GPT-4.1 for analyzing stolen data and tasking follow-on work. Separately...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.