Lasso Security Publishes Claude Code Attack Research, Then Ships the Open-Source Defense in the Same Repo

Lasso Security published research demonstrating that Claude Code's --dangerously-skip-permissions flag enables indirect prompt injection via poisoned READMEs, documentation files, and MCP responses. Then they did something unusual: they released the defense alongside the attack.

Their open-source claude-hooks project implements a PostToolUse hook with 50+ regex patterns across four attack categories: instruction override, role-playing manipulation, encoding/obfuscation, and context manipulation. When a tool returns content that matches an attack pattern, the hook intercepts it and injects a warning into Claude's context before processing continues. It's the first production-ready open-source defense for Claude Code's autonomous mode.

This matters because three independent security responses landed in the same week. Trail of Bits released their internal Claude Code security config with PreToolUse hooks that block dangerous patterns before execution. Anthropic shipped CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1 in v2.1.83, which strips credentials from every subprocess environment. Three different teams, three different approaches, all targeting the same attack surface.

The Claude Code v2.1.83 release itself is significant beyond the credential scrubbing. managed-settings.d/ lets organizations deploy modular policies. sandbox.failIfUnavailable enforces strict sandbox requirements. Transcript search via / key makes long sessions navigable. Over 50 bugs fixed. The --bare flag gives ~14% faster SDK performance.

For builders using Claude Code autonomously (and I know many of you are), here's your action list: install claude-hooks as a PostToolUse defender. Add CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1 to your shell profile. Review Trail of Bits' config for PreToolUse guardrails. If you're running --dangerously-skip-permissions without any of these, you're accepting a risk that now has documented, weaponized exploits and documented, tested defenses. There's no excuse for the former without the latter.