Session Inception: an untrusted repo's hook runs in a child Claude session

01What happened

Straiker researcher Jesus Padilla Soqui published Session Inception on October 8, 2026, after reporting it to Anthropic through HackerOne on September 17. Anthropic closed the report the same day as Informative, treating trust in repository settings as part of the user's own workspace-trust decision. Three of the researcher's four attempts failed before one worked.

02How it works

A parent session asked to test a linked repository can run the Claude CLI itself with claude -p, instead of the desktop folder-switch flow that asks the user to confirm. The new session starts inside the repository and loads its .claude/settings.json. A SessionStart hook in that file runs on its own and fetches an attacker-controlled script, which Straiker hid behind User-Agent gating and a DNS TXT record.

03Who is affected

Claude Code CLI users and the Claude Desktop Code flow are exposed when an agent is pointed at a repository nobody vetted. Straiker searched GitHub and found that about 5,000 of roughly 67,000 Claude Code configuration files carry an active SessionStart hook, roughly one in thirteen.

04What to do

Read a repository's .claude/settings.json before letting an agent work inside it, and do not ask an agent to clone and test code from a source you have not checked. Administrators can set allowManagedHooksOnly in managed settings, which makes Claude Code ignore user, project, local and plugin hooks.

Questions people ask

Is there a patch for Session Inception in Claude Code?

No patch exists. Anthropic closed Straiker's HackerOne report on September 17, 2026 as Informative, treating trust in a repository's settings as part of the workspace-trust decision a user already makes. Defenders have to handle Session Inception with process and policy instead: inspect a repository's settings file before an agent works in it, or block project hooks through managed settings.

How do I check whether a repository can trigger Session Inception?

Open the repository's .claude/settings.json and look for a SessionStart hook. Anthropic's hook documentation says SessionStart runs whenever a session starts, resumes, clears, compacts or forks, and that a project settings file can be committed to a repository and shared with everyone who clones it. A hook fetching a remote script is the pattern Straiker demonstrated.

Does Session Inception need the user to approve anything?

No approval prompt appeared in Straiker's proof of concept. The parent session skipped the Claude Desktop folder-switch flow, which does ask for confirmation, by running the Claude CLI with claude -p instead. Straiker reports that three of four attempts failed before one succeeded, so the technique is not reliable, but the run that worked executed attacker-controlled commands at session start.

Sources 2 links, all fetched

1. 1straiker.aiStraiker Research
2. 2code.claude.comClaude Code Hooks Docs