Claude Agent SDK: a dash in a resume id could run commands

01What happened

Anthropic published the advisory for this flaw on September 12, 2026 in the claude-agent-sdk-python repository. GitHub published the record for CVE-2026-96620 on October 16, 2026 and reviewed the advisory into the GitHub Advisory Database the same day, rating it 9.2 critical on CVSS v4. A researcher using the handle moamenmahmood reported the flaw through HackerOne.

02How it works

The SDK passed the resume option to the Claude CLI as its own argument without validating it. A value that begins with a dash was then read as a separate CLI flag, so an attacker could supply --mcp-config and define a stdio MCP server of their choosing. That server's command ran at CLI startup, which the advisory says bypassed the SDK's permission controls.

03Who is affected

Applications built on the claude-agent-sdk pip package below 0.2.121 are exposed when they pass untrusted input as the session id to resume. Services that resume only ids they generated themselves cannot be reached through this path.

04What to do

Update claude-agent-sdk to 0.2.121 or later. Where an application resumes sessions from values a user supplies, treat the session id as an opaque token you issued and reject anything that starts with a dash.

Questions people ask

Am I affected if my app uses the Claude Agent SDK for Python?

Applications on claude-agent-sdk below 0.2.121 are affected only when they pass untrusted input as the session id to resume. Anthropic's advisory states that exploitation requires an application to use attacker-controlled input as the session being resumed. A service that resumes sessions from ids it generated itself cannot be reached this way, though updating remains the safe choice.

Which version of claude-agent-sdk fixes CVE-2026-96620?

Version 0.2.121 of the claude-agent-sdk Python package fixes CVE-2026-96620. The release notes say --resume and --session-id are now passed as single argv tokens joined with an equals sign, so a dash-prefixed value can no longer be read as a separate CLI flag. The same release also hardened the build scripts against command injection through the CLAUDE_CLI_VERSION value.

Why did the CVE for this flaw appear a month after the advisory?

Anthropic published the repository advisory on September 12, 2026, and GitHub, acting as the CNA, published the CVE-2026-96620 record on October 16, 2026. The advisory was reviewed into the GitHub Advisory Database on the same day. Dependency scanners that read that database begin flagging claude-agent-sdk from today, which is why many teams see the alert now rather than in September.

Does this flaw get past the Claude Agent SDK permission controls?

Yes. The advisory states that the injected --mcp-config flag defines a stdio MCP server whose command runs at CLI startup, which bypasses the SDK's permission controls. Because the command runs as the CLI process starts, the SDK's tool approval settings never see the call. GitHub scored the result 9.2 on CVSS v4, with high confidentiality, integrity and availability impact.

Sources 5 links, all fetched

1. 1github.comGitHub Advisory
2. 2github.comAnthropic Advisory
3. 3github.comRelease 0.2.121
4. 4github.comFix Commit
5. 5cveawg.mitre.orgCVE Record