Claude Code Vulnerabilities Let Attackers Run Arbitrary Commands and Steal API Keys by Cloning a Repository
Check Point Research disclosed two CVEs in Anthropic's Claude Code that turned project configuration files into attack vectors, enabling remote code execution and API key exfiltration before users could approve a trust dialog.
Overview
Check Point Research disclosed two critical vulnerabilities in Anthropic’s Claude Code, the AI-powered command-line coding assistant, that allowed attackers to execute arbitrary shell commands on developers’ machines and steal Anthropic API keys — triggered simply by cloning and opening a malicious repository, according to the Check Point Research disclosure. The vulnerabilities exploited Claude Code’s Hooks automation system, Model Context Protocol (MCP) server configuration, and environment variable handling, all of which could be controlled through repository-level configuration files that developers typically treat as trusted metadata.
Anthropic has patched all reported issues. The full disclosure was published on February 25, 2026, after a responsible disclosure process that began in July 2025, according to Check Point Research.
The Vulnerabilities
CVE-2025-59536: Remote Code Execution via Hooks and MCP Bypass
Claude Code’s Hooks feature allows developers to define shell commands that execute automatically in response to session events — such as when a project is opened. Check Point researchers found that a malicious .claude/settings.json file placed in a repository could define a SessionStart hook that triggered arbitrary command execution during Claude Code initialization, before the user had a chance to review or approve the trust dialog, according to The Hacker News.
A second attack path exploited the MCP server configuration. Settings such as enableAllProjectMcpServers or enabledMcpjsonServers in the project configuration file could force Claude Code to initialize attacker-controlled MCP servers immediately upon launch, bypassing the consent dialog entirely, according to Check Point Research.
CVE-2026-21852: API Key Exfiltration via Environment Variable Override
A separate vulnerability allowed attackers to steal a developer’s Anthropic API key with no user interaction required. By overriding the ANTHROPIC_BASE_URL environment variable through the project’s .claude/settings.json, an attacker could redirect all of Claude’s API communications to an attacker-controlled server. Every API call included the full Anthropic API key in the authorization header, exposed in plaintext, according to Check Point Research.
With a stolen API key, attackers could access the victim’s workspace, regenerate non-downloadable files using Claude’s code execution capabilities, and access sensitive team resources, per Dark Reading.
Timeline
The disclosure spanned seven months. Check Point reported the initial Hooks vulnerability on July 21, 2025. Anthropic deployed a first fix on August 26, followed by a published GitHub Security Advisory (GHSA-ph6w-f82w-28w6) on August 29. Check Point then reported a consent bypass on September 3, which Anthropic patched on September 22. CVE-2025-59536 was published on October 3. The API key exfiltration vulnerability was reported on October 28, patched on December 28, and assigned CVE-2026-21852 on January 21, 2026. Full disclosure followed on February 25, according to the Check Point Research timeline.
Anthropic’s Mitigations
Anthropic implemented three categories of fixes: enhanced trust dialogs that explicitly warn users about potentially unsafe configurations in project directories, deferred MCP server execution that prevents initialization before user approval, and deferred API requests that ensure no network communications occur until users confirm the trust dialog. The company said it has additional security hardening features planned for future releases, according to Check Point Research.
The Supply Chain Implications
The vulnerabilities underscore a growing attack surface in AI-powered developer tools. Unlike traditional IDE extensions that execute code explicitly, AI coding assistants like Claude Code introduce configuration-driven automation that can be weaponized through repository files — the same files developers routinely clone, fork, and open without scrutiny.
The attack model mirrors concerns raised across the AI coding tool ecosystem. Earlier incidents have demonstrated prompt injection attacks against AI-powered issue triage bots, and researchers have documented how untrusted repositories can exploit agentic coding tools through indirect prompt injection in code comments, documentation files, and commit messages, according to CyberNews.
What We Don’t Know
Check Point and Anthropic have not disclosed whether either vulnerability was exploited in the wild before the patches were deployed. The seven-month window between the initial report and full disclosure leaves an extended period during which sophisticated attackers could have independently discovered the same flaws. The specific CVSS scores for each CVE have not been consistently reported across sources, with some citing 8.7 for CVE-2025-59536 and 5.3 for CVE-2026-21852, though these figures have not been confirmed in the official NVD entries.