Claude Code security
Anthropic's agentic coding tool for the terminal, IDEs and GitHub.
The Injection has tracked 7 security stories affecting Claude Code since September 17, 2026 (incident 3, vulnerability 2, benchmark 1, research 1), 1 rated high or critical. The most recent, disclosed October 8, 2026, is "ReversingLabs: behavior beat hashes on an AI-assisted spy campaign".
7
Stories
1
High or critical
1
With a CVE
2026-10-08
Latest disclosure
CVEs
| CVE | CVSS | Severity | Story |
|---|---|---|---|
| CVE-2026-103435 | 7.7 | Medium | Claude Code: symlink race allowed writes outside the project |
Every Claude Code story
INFO
Incident · ReversingLabs
ReversingLabs: behavior beat hashes on an AI-assisted spy campaignReversingLabs says it classified two GTG-20006 implants as malicious in August, two months before Anthropic's September report named the actor, and that behavior-based hunting held up while Claude was used to rebuild detected files.
INFO
Incident · CrowdStrike
ARTEX: attackers paired an agentic pentest tool with Claude CodeARTEX, an open-source agentic pentesting tool developed in China, was used alongside Claude Code and DeepSeek against South Korean financial organizations in late September 2026, CrowdStrike Intelligence reports.
INFO
Incident · SOCRadar
CyberXero: an access broker ran 51 Claude Code agents against UkraineCyberXero is a Russian-speaking initial access broker driving 51 specialized Claude Code agents. SOCRadar found its exposed working directory and confirmed theft of over 628,000 records from four Ukrainian organizations.
INFO
Benchmark · arXiv
HarnessSecurity-Bench: auto-approve lifts attack success to 95.6%HarnessSecurity-Bench tests nine security mechanisms across six coding agent harnesses and reports that enabling auto-approve raises attack success from 29.2% to 95.6%, while command denylisting cut attack effects with a utility gain.
MED
Vulnerability · Anthropic · CVE-2026-103435 · CVSS 7.7
Claude Code: symlink race allowed writes outside the projectCVE-2026-103435 is a time-of-check to time-of-use race in Claude Code before 2.1.129. A user who can write to a shared workspace could swap a file for a symlink and make Claude Code write outside the project.
MED
Research · arXiv
Explosive prompts: dormant injections fire on 'thanks' in agentsExplosive prompts are dormant prompt injections that wait for a harmless trigger such as 'thanks'. A new paper reports 43% to 83% success on nine production agents, versus at most 3% for plain injections, and proposes the DeFuse detector.
HIGH
Vulnerability · AIR Security
Plugin4Shell: zero-click plugin RCE in four AI coding agentsPlugin4Shell is a zero-click remote code execution flaw in how Claude Code, Codex, GitHub Copilot and Gemini CLI install pinned plugins. AIR says Claude Code and Codex are fixed, Copilot is not, and Gemini CLI will not be patched.
Questions people ask
- Does Claude Code have known security vulnerabilities?
- Yes. The Injection has tracked 1 story about Claude Code with a published CVE: CVE-2026-103435 (CVSS 7.7), symlink race allowed writes outside the project. Check each story for fixed versions.
- What is the latest Claude Code security issue?
- The most recent story is "ReversingLabs: behavior beat hashes on an AI-assisted spy campaign" (info severity), disclosed October 8, 2026 by ReversingLabs. ReversingLabs says it classified two GTG-20006 implants as malicious in August, two months before Anthropic's September report named the actor, and that behavior-based hunting held up while Claude was used to rebuild detected files.
- Which attack techniques have been used against Claude Code?
- Stories about Claude Code on The Injection most often involve ai threat intelligence, ai-enabled offense, coding agents, detection. Each technique has a glossary entry with a definition and every related story.