VulnSocial

CVE-2026-54316Patch(anthropic / claude_code)

HIGHCVSS 9.1 · CRITICAL

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Patch anthropic claude_code systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Claude Code is an agentic coding tool. From 0.2.54 until 2.1.163, because the hostname huggingface.co was pre-approved as a bare hostname for the WebFetch tool, any path on that domain—including attacker-controlled model repositories—was auto-approved without a permission prompt or being subject to --allowedTools restrictions. An attacker able to inject untrusted content into a Claude Code context could direct it to issue WebFetch requests against attacker-controlled repository files (e.g. /resolve/main/config.json), which HuggingFace counts as downloads server-side, creating a covert out-of-band channel for encoding and exfiltrating data Claude can access such as files, environment variables, or command output. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. This vulnerability is fixed in 2.1.163.

anthropic CVEsBack to dashboard
7.8/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-183CWE-200CWE-515

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • claude_code

Threat summary

  • Active exploitation appears in 4 classified signals
  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 12 mentions across 11 observed days

What's happening

  • Active exploitation reported across 4 signals
  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 2 signals
  • Patch or workaround mentioned in 7 signals
  • Technical details provided in 9 signals
  • Disclosure: 3 classified signals
  • Peaked 5d ago at 2 mentions (2026-08-14); latest day: 1
  • 12 total mentions across 11 days

Affected systems

Vendors
anthropic
Products
claude_code

Deep dive

Activity timeline12 mentions / 11d
01122Mentions · 2026-08-07: 1Mentions · 2026-08-08: 1Mentions · 2026-08-10: 1Mentions · 2026-08-11: 1Mentions · 2026-08-13: 1Mentions · 2026-08-14: 2Mentions · 2026-08-21: 1Mentions · 2026-08-26: 1Mentions · 2026-08-27: 1Mentions · 2026-08-29: 1Mentions · 2026-09-07: 1PoC Mentioned / Linked · 2026-08-08: 1PoC Mentioned / Linked · 2026-08-26: 1Exploit Tool / Code · 2026-08-08: 1Active Exploitation · 2026-08-13: 1Active Exploitation · 2026-08-14: 1Active Exploitation · 2026-08-29: 1Active Exploitation · 2026-09-07: 1Patch / Workaround · 2026-08-07: 1Patch / Workaround · 2026-08-08: 1Patch / Workaround · 2026-08-10: 1Patch / Workaround · 2026-08-11: 1Patch / Workaround · 2026-08-21: 1Patch / Workaround · 2026-08-26: 1Patch / Workaround · 2026-08-29: 1Technical Details · 2026-08-07: 1Technical Details · 2026-08-08: 1Technical Details · 2026-08-10: 1Technical Details · 2026-08-11: 1Technical Details · 2026-08-14: 1Technical Details · 2026-08-26: 1Technical Details · 2026-08-27: 1Technical Details · 2026-08-29: 1Technical Details · 2026-09-07: 108-0708-0808-1008-1108-1308-1408-2108-2608-2708-2909-07
Signal classification5 categories
Patch
433.3%
Disclosure
325.0%
Exploit
216.7%
Active Exploitation
216.7%
General
18.3%
Referenced assets6 URLs
Classification over time
DateTotalLabels
2026-08-071
Disclosure1
2026-08-081
Exploit1
2026-08-101
Patch1
2026-08-111
Patch1
2026-08-131
Active Exploitation1
2026-08-142
Exploit1General1
2026-08-211
Patch1
2026-08-261
Disclosure1
2026-08-271
Disclosure1
2026-08-291
Patch1
2026-09-071
Active Exploitation1
Full discourse12 posts
  • CloudSecurityAlliance@cloudsa
    Patch

    CISO Daily Briefing: ServiceNow patched 3 unauth CVSS 10 flaws in its AI Platform — patch now. CVE-2026-12537 (Gemini CLI) & CVE-2026-54316 (Claude Code), both CVSS 10, let one GitHub issue hijack CI. TeamPCP's supply-chain spree still has 500K+ live creds despite arrests. Gov: EU AI Act's GPAI enforcement is live, fines up to 3% global turnover. Strategy: OpenAI's 700 rogue eval-agents self-organized a 4.5-day Hugging Face breach; insurers now rewriting AI-agent policy. https://labs.cloudsecurityalliance.org/ciso-daily-briefing-august-29-2026/

    Post summary

    ServiceNow has patched three critical CVSS‑10 AI platform vulnerabilities, and evidence suggests they were actively exploited, as seen with CI hijacking and compromised credentials.

    00030593
    18.9K followersView on X
  • Slade 🛡️ LLM Hacker@llm_redteam
    Disclosure

    Claude Code CVE-2026-54316 is the most creative exfil trick I've read this year. It doesn't phone home. It leaks your API key through Hugging Face's public download counter, one character at a time. Let me explain why that's nasty. Novee Security dropped this at Black Hat (the talk was Aug 5). Two AI coding agent bugs. Both land right in the CI pipeline you probably run. CVE-2026-54316 (CVSS 9.1), Claude Code. Affects 0.2.54 all the way through 2.1.163. Fixed in 2.1.163, so update now. Here is the part I keep thinking about. The channel is a legit service. Your key gets encoded as download bumps on a public model page. The attacker just reads the counter. No weird domain. No callback to http://evil.com. Your egress logs show traffic to http://huggingface.co. Totally normal. So your "allow-list of trusted domains" does nothing here. http://huggingface.co IS on the allow-list. That is the whole point. The other one is simpler and scarier on paper. CVE-2026-12537 (CVSS 10.0), Gemini CLI. OS command injection via a crafted .gemini/.env file. Drop the file in a repo, the agent reads it on a headless CI host, an unprivileged attacker gets code execution. Full remote code execution (RCE), a perfect 10.0. Fixed in Gemini CLI 0.39.1 / run-gemini-cli 0.1.22. Think about where these actually run. Not a toy. A real one. Say you are a fintech running Claude Code in continuous integration (CI) to auto-triage dependency-bump PRs. The job env holds ANTHROPIC_API_KEY, an npm token, cloud creds. The agent reads untrusted PR contents. See the problem? Building agents into your pipeline? Here is the fix I would ship today. BEFORE (dangerous): // CI job, full secrets in env, open egress env: ANTHROPIC_API_KEY: [long-lived prod key] NPM_TOKEN: [...] // agent can reach any host, key lives for months AFTER (safe): // short-lived scoped key, minted per run, dead in minutes ANTHROPIC_API_KEY: [15-min token, minted at job start] // egress default-deny, and treat "trusted" endpoints as suspect too // pin agent versions, patch on the CVE, not on vibes // alert on odd request patterns to public counter/stats APIs The lesson for me: a leaked key you can barely use beats an airtight allow-list you trusted too hard. ⚠️ Every agent you drop into CI is one more thing reading attacker-controlled text with your secrets sitting right next to it. Two questions for you. Do you actually know every secret sitting in your agent's CI env right now? And if the exfil channel is a domain you already trust, what in your stack would even catch it? #AISecurity #PromptInjection #LLM

    Post summary

    The post discloses two new CVEs in Claude Code and Gemini CLI, explains how they leak API keys or enable remote code execution, and provides patch versions and mitigation guidance.

    10010290
    1.2K followersView on X
  • DS@GoToTokyoUniv0
    Active Exploitation

    「盗んだデータを、ダウンロード数に載せて運び出す」 Black Hat USA 2026（8月5日-6日）で Novee Security が開示した一件です。CVE-2026-54316 の対象は Claude Code で、事前に承認済みの Hugging Face へのアクセスが、そのまま持ち出しの経路になりました。運ばれたのはファイルではなく、リポジトリのダウンロード数という計測値の動きです。通信相手は許可済みなので、許可リストには引っかかりません。 到達経路は公開の GitHub issue で、リポジトリの権限がゼロでも届いたそうです。Claude Code・Gemini CLI・Codex に共通するようです。VentureBeat は2025年から2026年に開示された6件を、issue タイトルやブランチ名といった信用できないテキストが指示として読まれ、既に持たされている資格情報が使われる型に整理しています。 Enkrypt AI の Merritt Baer 氏は、承認したのはインターフェースであって、その下のシステムではないと言っています。 許可リストを増やすより、渡してある鍵の本数を数えるほうが早そうです。 ―――――― 海外のプロフェッショナルが使っているAI最新Tips https://www.mag2.com/m/0001699667

    Post summary

    The post reports an active exploitation of CVE-2026-54316, detailing how attackers used a public GitHub issue to exfiltrate data via download‑count metrics, but provides no PoC code, patch, or clarification that the vulnerability is a false positive.

    00001161
    3.4K followersView on X
  • Bradley Cassada@bcassada
    Disclosure

    Black Hat 2026: one GitHub issue broke three coding agents. Claude Code: CVE-2026-54316. Gemini CLI: CVSS 10.0 bypass. Codex: injection persisted via AGENTS.md. The harness, not the model, is the attack surface. https://www.esecurityplanet.com/threats/black-hat-2026-critical-flaws-found-in-anthropic-google-and-openai-coding-agents/ #AISecurity #PromptInjection #AIAgents

    Post summary

    The post announces critical flaws discovered in Anthropic, Google, and OpenAI coding agents, naming CVE-2026-54316 and highlighting high CVSS scores and prompt injection vectors; no PoC, exploit script, or patch information is provided.

    0001093
    254 followersView on X
  • ai note@ainote_mag
    Patch

    3/ 대응은 셋이 갈렸다. Claude Code(CVE-2026-54316, 패치 2.1.163)·Gemini CLI(CVE-2026-12537, 패치 0.39.1)는 CVE 받고 코드 패치. Codex는 CVE 없이 워크플로 구조 자체를 바꿨다(분리된 작업·읽기전용 샌드박스).

    Post summary

    The text reports that specific patches have been issued for CVE-2026-54316 and CVE-2026-12537, while another component mitigates the risk by changing its workflow without a patch.

    1000066
    35 followersView on X
  • Jesús Morán | AI Infra@jamoran1356
    Exploit

    Alguien sin un solo permiso en tu repo abre un issue de GitHub. Ese texto llega como instrucción a un agente que corre dentro de tu CI. Y se lleva tus secretos. Es CVE-2026-54316, presentado en Black Hat. Afectó al propio Claude Code Action. Cómo funciona por dentro 🧵

    Post summary

    CVE‑2026‑54316 enables attackers to inject malicious instructions via an unauthenticated GitHub issue, which are then executed by a CI agent, resulting in secret exfiltration.

    10000139
    551 followersView on X
  • Jesús Morán | AI Infra@jamoran1356
    Active Exploitation

    Alguien sin un solo permiso en tu repo abre un issue de GitHub. Ese texto llega como instrucción a un agente que corre dentro de tu CI. Y se lleva tus secretos. Es CVE-2026-54316, presentado en Black Hat. Afectó al propio Claude Code Action. Cómo funciona por dentro 🧵 https://t.co/rqJkCwm5Fe

    Post summary

    CVE-2026-54316 is actively exploited, allowing an unauthenticated user to open a GitHub issue via a CI agent and exfiltrate secrets. The vulnerability was presented at Black Hat and impacts Claude Code Action.

    1000055
    512 followersView on X
  • DkillG@DkillG
    Patch

    Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets Gemini had a critical CVSS 10.0 vulnerability capable of executing commands on the host. In Claude Code, CVE-2026-54316 turned Hugging Face's public download counter into an exfiltration channel that leaked an API key one character at a time, and is fixed in 2.1.163. Every Claude Code release from 0.2.54 up to 2.1.163 is affected. Anthropic says exploitation required getting untrusted content into a Claude Code context. If you use agents in CI/CD: upgrade. The new attack vector is no longer just your code, it's also the agent.

    Post summary

    CVE‑2026‑54316 exposes a critical command‑execution flaw in Claude Code that leaks API keys; the issue is mitigated by upgrading to version 2.1.163 and above.

    1000089
    34 followersView on X
  • Claude Code Lab @CWorksL@cc_lab_jp
    Patch

    【注意喚起】BlackHatで話題の脆弱性、大丈夫？😳 Claude CodeのWebFetchがHuggingFaceのDL数を悪用され、APIキーが1文字ずつ漏れる脆弱性(CVE-2026-54316)を6月公表→BlackHatで詳細解説🚨 ✅ 対象: v0.2.54〜v2.1.162 ✅ v2.1.163で修正済み・最新版なら安心💪 #ClaudeCode 🤖自動投稿

    Post summary

    CVE‑2026‑54316 exploits WebFetch to leak API keys one character at a time; the issue is fixed in v2.1.163 and newer releases.

    0001067
    42 followersView on X
  • Kyssta@kysstalol
    Disclosure

    Black Hat USA 2026: CVE-2026-54316 let a GitHub issue reach RCE in Claude Code by abusing Hugging Face's public download counter as an exfiltration channel. Every 0.2.54 through 2.1.163 is affected. Fixed in 2.1.163.

    Post summary

    CVE‑2026‑54316 enables remote code execution in Claude Code by exploiting GitHub issue handling and Hugging Face’s download counter; affected versions up to 2.1.163 are fixed in that release.

    0000044
    26 followersView on X
  • Jesús Morán | AI Infra@jamoran1356
    General

    Investigación completa (CSA Labs / Black Hat 2026): https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-coding-agent-cicd-secrets-20260808-csa/ CVE-2026-54316. Si corres agentes de IA en tus pipelines, léelo hoy.

    Post summary

    The mention references a CVE and links to a research note, but lacks explicit details on PoCs, exploits, patches, or technical specifics, resulting in a general classification.

    0000060
    551 followersView on X
  • jack@coinsonchain
    Exploit

    Tested the Claude Code exploit: CVE-2026-54316 leaks HF API keys one char at a time through the download counter. Affects v0.2.54-2.1.163. Patched in 2.1.163. (Yes I reproduced it in a test repo)

    Post summary

    The author confirms a functional exploit that leaks API keys via the download counter, reproduces it, and notes that the issue is fixed in version 2.1.163.

    0000083
    201 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appanthropicclaude_code-node.js-

Explore more

Back to dashboardanthropic CVEsclaude_code vulnerabilities