Check Point Research and Anthropic disclosed critical security vulnerabilities in Claude Code, an agentic AI coding tool. The flaws allowed attackers to execute arbitrary shell commands and exfiltrate sensitive API keys by tricking users into opening malicious project directories. 

Key Vulnerabilities

The vulnerabilities leveraged “supply chain” attack vectors, where a malicious repository configuration (e.g., in a .claude/settings.json file) could trigger actions without user consent. 

• Remote Code Execution (RCE) via Hooks (CVE-2025-59536): Attackers could define malicious “hooks” (scripts that run during tool operations) in a repository’s settings. These commands would execute automatically upon tool initialization, before the user even had a chance to read or approve the tool’s “trust” dialog. Check Point Research
• API Key Exfiltration (CVE-2026-21852): By overriding the ANTHROPIC_BASE_URL environment variable in a project’s configuration, an attacker could redirect all of Claude Code’s API traffic to a server they controlled. This allowed them to capture the user’s Anthropic API key immediately when the tool started, with no user interaction required.
• MCP Server Abuse: Malicious configurations could also force the tool to load “rogue” Model Context Protocol (MCP) servers, which could then be used to perform unauthorized filesystem operations or network requests.

Impact of Stolen API Keys

Researchers found that a stolen API key provides more than just billing access; it allows an attacker to:

• Access Workspaces: Read and write all files in the user’s Claude.ai workspaces by regenerating them through the code execution tool to bypass download restrictions.
• Persistent Access: Upload arbitrary files to poison future development work or exhaust account storage quotas. Check Point Research

Remediation & Status

Anthropic worked closely with researchers to patch these issues before public disclosure. 

• Version 2.0.65+: These vulnerabilities have been fully remediated. Ensure your Claude Code CLI is updated to the latest version. Claude Code Docs
• Security Hardening: Anthropic implemented enhanced warning dialogs and restricted network/MCP operations until after explicit user consent is granted.