Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-17 · high
A crafted device-prefixed path could reach a remote server and leak login credentials on connect, per the 2.1.233 changelog.
Why now: The fix landed in the 2026-08-17 changelog entry for version 2.1.233.
Claude Code 2.1.233 closes a Windows path bug that could leak NTLM credentials to a remote server on connect, per the changelog. Anyone running Claude Code on Windows at version 2.1.232 or earlier is exposed, and the fix means upgrading to 2.1.233 now.
Paths written with the NT device prefix \??\ bypassed Claude Code's UNC path validation, according to the changelog. That let a crafted path point at a remote SMB server. Windows would then send NTLM credentials to it automatically on connect.
A second bug shipped in the same release, this one in the skills layer. Skill and command arguments were being re-expanded as template markers. That meant a value passed as an argument could get interpreted as an instruction instead of data, an injection-shaped flaw. The changelog groups both fixes together but doesn't say whether either was found through a bug bounty, internal review, or an external report.
The sharper read: a credential leak that fires on connect, with no extra step described in the changelog, is worse than most higher-severity CVEs. Worth watching is whether a later changelog entry discloses how long the \??\ bypass existed, since that answers whether credentials were already exposed before 2.1.233.
Each link below shares sources, entities, or timing with this story.
One Claude Code release fixed two independent permission-check bypasses on the same day. That's the story. Version 2.1.221, shipped August 4, patches a Bash tool bypass where zsh could execute hidden commands embedded inside [[ ]] regex conditionals. The approval prompt never...
Released August 15, v2.1.233 fixes Windows paths written with the NT device prefix \??\ slipping past UNC path validation. It follows the Git Bash Cygwin-symlink bypass and the PowerShell variable-writing parameter bypass in 2.1.232. The same release stops nested git repositor...
It now dedupes local CLAUDE.md files against checked-in ones, proposes trimming content it can derive from the codebase, ranks unused skills, MCP servers, and plugins by context cost, and flags slow hooks. Background subagents run by default and, when launched from claude agen...
SkillsMetric evaluated 2,266 skills across 16 attack types, hitting F1 of 73.4%±0.5% overall (arXiv 2608.08468). Host destruction via shell commands: 0% detection. Natural-language prompt injection: 42%. If you lint third-party skills before install, this tells you precisely w...
Claude Code 2.1.232 shipped August 13 with a default flipped underneath everyone. Subagent forking is now on: a spawned subagent inherits the full parent conversation and shares its prompt-cache prefix instead of starting cold. Nested spawn depth defaults to 3. Practitioner wr...
It scans prompts and tool descriptions for patterns written for older model generations. This targets a real invisible tax: system prompts and MCP tool descriptions accumulate verbose few-shot blocks, defensive formatting instructions, and reasoning nudges that earned their ke...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.