A newly disclosed flaw in Claude Code, Anthropic’s AI coding assistant, allows an attacker-controlled repository to silently read files from outside the project directory and transmit their contents to a remote server, before the AI model performs any action and without triggering any approval dialog.
The issue lies in Claude Code’s memory-loading feature, which reads project instructions from CLAUDE.md and files under .claude/rules/**.
These files support an @import directive that pulls external content into the model’s context at session startup, a pattern Anthropic’s own documentation recommends for syncing shared instruction files.
Claude Code Symlink Flaw
The vulnerability, researched by Tomer Niv, stems from a mismatch between how Claude Code validates an import path and how it actually reads it. The tool checks whether an @import target is “external” using the literal, pre-resolution path.
If a repository contains an in-tree symlink, such as @./link, pointing to a file outside the project (e.g., /etc/passwd or ~/.aws/credentials), the classifier sees only the internal-looking path ./link and treats it as safe.
When the file is actually read, the operating system follows the symlink to the real, out-of-tree target.
The result: sensitive file contents are injected into the model’s context and labeled as “project instructions, checked into the codebase,” even though the resolved file has nothing to do with the repository. No tool_use or file-read action occurs, so there’s no natural checkpoint for a security prompt.
Claude Code has a built-in control for exactly this scenario: an external-import approval dialog that should appear the first time a memory file references content outside the project.
Because the classifier evaluates the symlink’s literal path rather than its resolved target, that dialog never triggers for symlinked imports.
Testing confirmed that a direct external import shows up in the approval dialog, while an identical target reached through a symlink is omitted entirely.
Compounding this, Claude Code’s workspace-trust model applies an ancestor-directory walk: trusting a parent folder like ~/dev silently extends that trust to every repository cloned beneath it, with no new prompt.
On real developer machines, broad trusted roots (including entire home directories) were found already active.
Once loaded, the file content is included in the very first outbound HTTPS request Claude Code sends to its configured API endpoint, by default api.anthropic.com.
/etc/passwd2 daemon entries highlighted inline (Source: tego.ai)If a repository commits a .claude/settings.json with an ANTHROPIC_BASE_URL override, that same request can be redirected to an attacker-chosen host, carrying the exfiltrated data with it.
This is a related but distinct issue from the previously patched CVE-2026-21852, which leaked API keys via the same environment variable before the trust prompt ran.
This marks the third time a symlink-related path-validation gap has surfaced in Claude Code, following CVE-2025-59829 and CVE-2026-25724, both fixed in the permission subsystem.
The memory-loader code path was never updated with the same fix, leaving it exposed on Claude Code v2.1.215 and likely other 2.1.x builds.
Reported to Anthropic via HackerOne on July 18, 2026, the issue was closed as “Informative” two days later. Anthropic maintains that workspace-trust acceptance already authorizes this behavior under its threat model, treating the external-import dialog as a usability aid rather than an enforced security boundary.
Mitigation: Users can audit trusted directories by running jq -r '.projects|to_entries[]|select(.value.hasTrustDialogAccepted==true)|.key' ~/.claude.json on macOS/Linux, and should avoid cloning untrusted repositories into previously trusted parent directories.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
