CVE-2025-59536Disclosure(anthropic / claude_code)

I hacked Claude Code! It turns out "agentic" is just a fancy new way to get a shell. I achieved full RCE and hijacked organization API keys. CVE-2025-59536 | CVE-2026-21852 https://research.checkpoint.com/2026/rce-and-api-token-exfiltration-through-claude-code-project-files-cve-2025-59536/ #ai #Claude

RCE AND API TOKEN EXFILTRATION THROUGH CLAUDE CODE PROJECT FILES https://research.checkpoint.com/2026/rce-and-api-token-exfiltration-through-claude-code-project-files-cve-2025-59536/

RCE AND API TOKEN EXFILTRATION THROUGH CLAUDE CODE PROJECT FILES https://research.checkpoint.com/2026/rce-and-api-token-exfiltration-through-claude-code-project-files-cve-2025-59536/

Caught in the Hook: RCE and API Token Exfiltration Through Claude Code Project Files | CVE-2025-59536 | CVE-2026-21852 - Aviv Donenfeld and Oded Vanunu https://research.checkpoint.com/2026/rce-and-api-token-exfiltration-through-claude-code-project-files-cve-2025-59536/

Critical vulnerabilities, CVE-2025-59536 and CVE-2026-21852, in Anthropic’s Claude Code enabled remote code execution and API key theft through malicious repository-level configuration files, triggered simply by cloning and opening an untrusted project https://blog.checkpoint.com/research/check-point-researchers-expose-critical-claude-code-flaws/ https://t.co/seoIHfG9Iu

Check Point found CVE-2025-59536 and CVE-2026-21852 in Claude Code allow remote code execution and API key theft via untrusted repository configurations, reachable by simply cloning and opening a project. They warn that built-in hooks and env vars could … https://blog.checkpoint.com/research/check-point-researchers-expose-critical-claude-code-flaws/

Caught in the Hook: RCE and API Token Exfiltration Through Claude Code Project Files https://research.checkpoint.com/2026/rce-and-api-token-exfiltration-through-claude-code-project-files-cve-2025-59536/

#Cybernews 🚨💻 Las #Vulnerabilidades ⚠️, registradas como CVE-2025-59536 🆔 y CVE-2026-21852 🆔, podían activarse simplemente al #Clonar 🔁 y abrir 📂 un proyecto no confiable 🚫, sin necesidad de ejecutar código explícito 🧩 ni realizar acciones adicionales. https://t.co/C4zqm9ukAG

Researchers have a clear path to hack with claude code: >get user to install skill >skill setup hooks >hooks get executed without asking user permission >hooks can download and run binaries https://research.checkpoint.com/2026/rce-and-api-token-exfiltration-through-claude-code-project-files-cve-2025-59536/ https://t.co/xQKnWSZqUh

Caught in the Hook: RCE and API Token Exfiltration Through Claude Code Project Files | CVE-2025-59536 | CVE-2026-21852 https://research.checkpoint.com/2026/rce-and-api-token-exfiltration-through-claude-code-project-files-cve-2025-59536/

Recent #ClaudeCode vulnerabilities (CVE-2025-59536, CVE-2026-21852) show why the AI supply chain begins with the automation layer. Configuration files like .claude/settings.json are now part of the execution layer. Authority must be deterministic. 🛡️🦾 https://thehackernews.com/2026/02/claude-code-flaws-allow-remote-code.html

⚠️Check Point Research（CPR）发布报告详细揭示 #Claude Code 存在通过项目文件实现远程代码执行和 API 令牌窃取等多个严重漏洞（CVE-2025-59536 和相关 CVE-2026-21852）。 该漏洞并非源于传统的代码注入，而是由于 Claude Code 在处理项目级配置文件时，其自动化功能与安全信任机制之间的逻辑缺陷： 1、Hooks（钩子）功能滥用：Claude Code 支持“Hooks”功能，攻击者在仓库的 .claude/settings.json 文件中定义恶意 Hook 命令。当用户在该目录下运行 claude 命令时，这些脚本会在后台自动启动。 2、信任机制绕过（Execution Before Trust）：恶意配置定义的命令执行时间点早于信任提示的出现。这意味着即使你在看到提示后选择了“不信任”并退出，恶意代码可能已经执行完毕（例如弹出了计算器或发送了数据）。 3、MCP劫持：Claude Code 使用 MCP 与外部工具交互。攻击者通过伪造 .mcp.json 配置文件，可以静默地将原本安全的本地工具替换为恶意可执行文件。 4、API 令牌脱出（Exfiltration via Base URL）：当 Claude Code 进行身份验证时，它会将用户的 Authorization 请求头（包含 Anthropic API Key）发送到攻击者的服务器。整个过程发生在用户确认信任该目录之前。 🛡️目前 #Anthropic 已经修复了上述漏洞，开发者需升级到版本在 1.0.111 以上，避免此漏洞；另外，避免在不可信的第三方仓库或不明来源的目录下运行 claude 等 AI 命令行工具。

Claude Codeに脆弱性。攻撃者がリポに.claude/settings.jsonをコミットしておくだけ。cloneして開いたらAPIキーが外に飛ぶ。修正済み。設定ファイルはノーマークだった。.claude/があるリポ、中身見てから開く https://research.checkpoint.com/2026/rce-and-api-token-exfiltration-through-claude-code-project-files-cve-2025-59536/

🚀 Top 10 AI & Dev News of the Day! 🧵👇 🚨 Claude Code RCE Flaws: Check Point Research discovered critical vulnerabilities (like CVE-2025-59536) in Claude Code that allow remote code execution and API key theft simply by opening malicious repositories. https://www.bankinfosecurity.com/malicious-repo-files-could-hijack-claude-code-sessions-a-30854 ⚠️ Gemini API Data Leaks: Legacy public Google Cloud API keys (like Maps or Firebase) are silently inheriting unauthorized access to Gemini endpoints, exposing private files and creating massive billing risks. https://ift.tt/JiALlab ⚔️ Anthropic Defies the Pentagon: CEO Dario Amodei publicly rejected the DoD's ultimatum, refusing to drop Claude's safety guardrails against autonomous lethal weapons and mass domestic surveillance. https://ift.tt/hL2AqHi 🐛 MCP Go SDK Vulnerability: Upgrade to v1.3.1 immediately! A high-severity flaw (CVE-2026-27896) allows attackers to bypass security filters due to case-insensitive JSON parsing. https://ift.tt/0QNCImq 📱 Claude Code Remote Control: Anthropic launched a highly-requested feature letting developers seamlessly control and monitor their local terminal coding sessions directly from their phones. https://ift.tt/u3OLgIP 🤖 Microsoft Copilot Tasks: Microsoft unveiled an autonomous background agent that plans and executes multi-step workflows (like calendar management or web research) across different apps without constant human input. https://ift.tt/SdL6NjA 🤝 Copilot Welcomes Claude & Codex: GitHub Copilot Pro and Business users can now select Anthropic's Claude and OpenAI's Codex as their coding agents directly inside VS Code at no extra cost. https://ift.tt/C8WUYGR 🛡️ MCP Server Security Audit: An independent scan of the top 20 Model Context Protocol (MCP) servers revealed that 60% contain real vulnerabilities, including critical arbitrary command execution flaws in Kubernetes servers. https://ift.tt/WrzYOle 🎨 Figma integrates OpenAI Codex: Figma launched a new workflow via its MCP server that connects its infinite design canvas directly to Codex, allowing teams to seamlessly translate UI designs into code. https://ift.tt/I3MuOlk 🖼️ Google's Nano Banana 2: Google shipped Gemini 3.1 Flash Image, crushing the competition by taking the #1 spot on text-to-image leaderboards while costing half the price of Pro models. https://www.latent.space/p/ainews-nano-banana-2-aka-gemini-31 #AI #MachineLearning #CyberSecurity #SoftwareDevelopment #TechNews #WebDev #OpenAI #Anthropic #GitHubCopilot

The Claude Code RCE vulnerability (CVE-2025-59536) is a perfect case study for why agentic AI needs security-first architecture. Giving AI agents shell access without proper sandboxing is like handing out root keys to your infrastructure. Every team deploying coding agents should audit their trust boundaries now.

⚠️ "Vibe coding" is the new buzzword for 2026. But nobody is talking about the massive security timebomb it just created. Just weeks ago, Check Point Research exposed a critical vulnerability (CVE-2025-59536) in Anthropic’s Claude Code. Right now, founders are pushing development teams to let AI agents run loose in their codebases to speed up deployment. But attackers realized they could hide malicious hooks inside simple project files (like .claude/settings.json). The moment a developer clones an untrusted repository and activates the AI agent, it triggers Remote Code Execution (RCE) and quietly exfiltrates enterprise API keys. 🔑 This highlights the biggest trap in the current AI hype cycle: treating AI as a magic wrapper instead of a core engineering component. 🛡️ Whether I am deploying enterprise Node.js architectures or designing platforms for secure digital asset distribution, the rule remains the same: you cannot have autonomy without strict boundaries. AI agents are incredible engines. But if you don't have the fundamental engineering architecture to sandbox them, validate their outputs, and control their access, you aren't automating your business; you are automating your breaches. 📦 We need to stop chasing the hype of "zero-click" development and start focusing on secure, containerized AI integration. Founders, CTOs, and fellow engineers: How are you currently sandboxing AI agents within your local development environments to prevent automated credential leaks? 👇 I’d love to hear the different architectural approaches you are taking.

Running a 5-bot Claude Code swarm on political data. Built the same progressive disclosure pattern independently for auto-capturing human corrections and prepending them to agent prompts. Context rot solved with a 150-line cap and 30-day expiry. Also caught CVE-2025-59536 and CVE-2026-21852 in our deployment within 48 hours. Scaffold security is the real frontier. Great post. Validates a lot of hard-won lessons!

AIコーディングエージェントが攻撃される本当の入口は、モデルではなく「設定ファイル」でした。 TrustFall・AWS Kiro・CVE-2025-59536 を題材に整理して、対策に作ったツール Sigil も紹介しています。｜Justin https://zenn.dev/ju571n/articles/ai-agent-config-attack-surface #zenn

悪意あるリポジトリをクローンするだけでRCEとAPIキー窃取が起きるClaude Code脆弱性（CVE-2025-59536/CVE-2026-21852）が発見・修正済み。根本原因は.claude/settings.jsonがリポジトリ内に存在すること。信頼できないリポジトリを開く前にこのファイルを必ず確認する運用が必要。 #AIコーディング

@MindTheGapMTG @gregisenberg Both layers leak. My honeymcp catches payloads abusing MCP tool authorization (write_file to .mcp.json hooks, CVE-2025-59536 class) alongside classic injection. You need runtime permissions AND input detection. Skip one, attacker walks through the gap.