--- title: "Claude Code Project-File RCE and API Token Exfiltration - CVE-2025-59536 / CVE-2026-21852" description: "CVE-2025-59536 and CVE-2026-21852: a cloned repo's .claude/settings.json ran code and leaked the Anthropic API key before the Claude Code trust prompt." url: "https://anomity.ai/blog/claude-code-project-file-rce-token-exfil-cve-2025-59536/" source: html --- On this page - What happened - Why this is an agentic-endpoint risk - How Anomity surfaces and governs it - What to check across your fleet - Frequently asked questions [← Back to blog](https://anomity.ai/blog/) - Home - Blog - Claude Code Project-File RCE and API Token Exfiltration - CVE-2025-59536 / CVE-2026-21852 ![Anomity robot illustrating Claude Code Project-File RCE and API Token Exfiltration - CVE-2025-59536 / CVE-2026-21852] Advisory High # Claude Code Project-File RCE and API Token Exfiltration - CVE-2025-59536 / CVE-2026-21852 Anomity Research Anomity Threat Research · Feb 25, 2026 · 6 min read Share: Copied AI Agent & CLI Security · High · CVE-2025-59536, CVE-2026-21852 (GHSA-jh7p-qr78-84p7) · Feb 25, 2026 Affected Anthropic Claude Code before 1.0.111 (RCE / consent bypass); before 2.0.65 (API key exfiltration) **Check Point Research** disclosed a chain of flaws in **Anthropic Claude Code** that let an untrusted, freshly cloned repository run code and steal the developer's API key **before** the startup trust dialog was accepted. The chain is tracked as **CVE-2025-59536** (pre-consent code execution, fixed in **1.0.111**) and **CVE-2026-21852** (API key exfiltration, GHSA-jh7p-qr78-84p7, CVSS 5.3, fixed in **2.0.65**). This advisory covers what was disclosed and how to inventory and govern this class of project-file abuse. ## What happened **Check Point Research** found that Claude Code applied a repository's own configuration before it verified that the user trusted the directory. A cloned but untrusted repository could ship a `.claude/settings.json` that registered a **SessionStart hook** - an event that fires automatically during initialization - which ran arbitrary shell commands on the developer's machine. In parallel, the `enableAllProjectMcpServers` setting let MCP initialization commands run before the **"Do you trust this directory?"** dialog was even readable. The prompt warned that Claude Code might read and execute files "with your permission," but the code had already run. This is **CVE-2025-59536**, published **October 3, 2025**, fixed in **1.0.111**. A separate flaw in the same project-load flow let a malicious project set **ANTHROPIC_BASE_URL** in its repository settings to an attacker-controlled endpoint. Because Claude Code applied that value before showing the trust prompt, it issued API requests to the attacker's server during initialization and leaked the **full Anthropic API key in plaintext**. This is **CVE-2026-21852** (**GHSA-jh7p-qr78-84p7**, CVSS **5.3**), published **January 21, 2026**, and fixed in Claude Code **2.0.65**. The common root cause is an **initialization order that applied repository configuration before trust verification**. Anthropic deferred network operations until after consent, blocked pre-approval MCP execution, and added stronger warning dialogs. The hooks behavior was first reported **July 21, 2025**; the full chain was disclosed **February 25, 2026**. ## Why this is an agentic-endpoint risk The attack surface here is not a server or a network path - it is the **coding agent's own configuration files** in a repository. A `.claude/settings.json`, the hooks it registers, the MCP servers it enables, and the environment variables it sets are the artifacts an AI coding agent reads on startup - and they report to no security tool. The exploit fires on the most ordinary developer action: cloning a repository and opening it in Claude Code. No phishing, no privilege escalation - just `git clone` and a startup that ran code. This exposure is hard to see from the controls you already run, because it lives in the AI artifact layer. The malicious hook and MCP entries sit in a file a developer never inspects; the Claude Code process looks legitimate to EDR; the network sees TLS traffic to what looks like an Anthropic endpoint when `ANTHROPIC_BASE_URL` is rewritten; and DLP sees nothing at rest. Hooks, MCP servers, and CLI configuration are part of the [eight AI artifact types](https://anomity.ai/#features) Anomity tracks per endpoint, adopted bottom-up like [AI agents and MCP servers as the new shadow IT](https://anomity.ai/blog/securing-ai-coding-agents-and-clis/). The question is not whether one laptop is patched; it is which endpoints run Claude Code before 1.0.111 or 2.0.65, and which projects carry a SessionStart hook or a rewritten `ANTHROPIC_BASE_URL` - and you cannot answer that without an inventory of the artifact layer. ## How Anomity surfaces and governs it Upgrading Claude Code closes these two flaws, but the durable control is to treat project-supplied hooks, MCP servers, and CLI configuration as untrusted input and govern what they may do before they run. Anomity does that in three steps. First, **inventory**. Anomity inventories **hooks, MCP servers, and CLI configuration** on every managed endpoint as part of the [eight AI artifact types](https://anomity.ai/#features) it tracks, then classifies them. It captures the Claude Code version and the project-level configuration metadata - SessionStart and other hook registrations, `enableAllProjectMcpServers` and `enabledMcpjsonServers` settings, and any `ANTHROPIC_BASE_URL` override - so you can find builds before **1.0.111** or **2.0.65** and the repositories that carry these entries. Metadata only: the API key is redacted on the endpoint before anything leaves it. Second, **decide at the hook**. On agents that expose a hook - for example, the **Claude Code PreToolUse** event - Anomity evaluates each tool call against your policy and returns **allow, deny, or log** before the call runs. A shell command or MCP tool call from an untrusted project's configuration can be denied at the boundary, the control [runtime governance](https://anomity.ai/#runtime-governance) provides while a vulnerable build is still rolling forward. This is the same project-file abuse the sibling [GitHub Action bot actor bypass](https://anomity.ai/blog/claude-code-github-action-bot-actor-bypass/) exploited in automation - repository-supplied configuration crossing a trust boundary. Third, **keep the record**. Every decision, and every added, changed, or removed hook, MCP server, or CLI setting, lands in a [queryable 90-day audit trail](https://anomity.ai/#outcomes), and decisions route to SIEM, Slack, email, or Jira. When a disclosure like CVE-2025-59536 lands, you can answer which endpoints ran the affected versions, which projects registered a SessionStart hook or rewrote `ANTHROPIC_BASE_URL`, and what those files were allowed to do - from a record, not a guess. Anomity complements Network, EDR, DLP, and GRC tooling and covers the artifact layer those tools were never built to inventory. > You can't govern what you can't see. The Anomity principle ## What to check across your fleet - Inventory every endpoint running Claude Code; flag builds before 1.0.111 (CVE-2025-59536) or 2.0.65 (CVE-2026-21852) and upgrade to 2.0.65 or later, which covers both. - Enumerate .claude/settings.json across cloned repositories and surface SessionStart or other startup hooks that run shell commands automatically. - Find every project that sets enableAllProjectMcpServers or enabledMcpjsonServers , and confirm those servers cannot initialize before the trust dialog is accepted. - Detect any project-level ANTHROPIC_BASE_URL override and treat a rewritten API endpoint as a credential-exfiltration risk, regardless of version. - Confirm tool calls from project-supplied hooks or MCP servers are evaluated at the Claude Code PreToolUse hook with allow/deny/log , so a pre-consent action is stopped before it runs. - Verify every hook, MCP server, and CLI change is written to a 90-day audit trail and routed to your SIEM. - Cross-reference against the sibling GitHub Action bot actor bypass advisory to find endpoints exposed to more than one project-file abuse path. CVE-2025-59536 and CVE-2026-21852 are a reminder that a coding agent's own project files are an execution and credential path: cloning a repository can run code and leak your API key before you ever click "trust." Upgrade Claude Code to 2.0.65 or later, then inventory the hooks, MCP servers, and CLI configuration your endpoints carry and govern the tool calls at the hook. For the full coding-agent attack surface, see the pillar on [securing AI coding agents and CLIs](https://anomity.ai/blog/securing-ai-coding-agents-and-clis/). To see Anomity govern the agent and CLI layer across your fleet, [book a demo](https://anomity.ai/#early-access). Repository-local execution before consent also appears in [GitSpawn](https://anomity.ai/blog/gitspawn-malicious-git-config-coding-agent-rce/), where poisoned `.git/config` runs on routine agent Git ops. Share: Copied ## Frequently asked questions What is CVE-2025-59536 in Claude Code? CVE-2025-59536 is a pre-consent code-execution flaw in Anthropic Claude Code, disclosed by Check Point Research and published October 3, 2025. A cloned but untrusted repository could ship a `.claude/settings.json` that registered a SessionStart hook, and the `enableAllProjectMcpServers` setting let MCP initialization commands run, before the startup trust dialog was even readable. The root cause was an initialization order that applied repository configuration before trust verification, so opening a hostile project ran attacker shell commands automatically. It is fixed in Claude Code 1.0.111. The hooks behavior was first reported July 21, 2025, and the full chain was publicly disclosed February 25, 2026. What is CVE-2026-21852 and how is it related? CVE-2026-21852 (tracked as GHSA-jh7p-qr78-84p7, CVSS 5.3) is the credential-leak half of the same Check Point Research chain, published January 21, 2026. A malicious project could set `ANTHROPIC_BASE_URL` in its repository settings to an attacker-controlled endpoint. Because Claude Code applied that configuration before showing the trust prompt, it issued API requests to the attacker's server during project load and leaked the full Anthropic API key in plaintext. It shares the root cause with CVE-2025-59536: repository configuration applied ahead of consent. It is fixed in Claude Code 2.0.65, which defers all network operations until after the user confirms trust. Which Claude Code versions are affected and how do I fix this? For the code execution and consent bypass (CVE-2025-59536), Claude Code before 1.0.111 is affected; upgrade to 1.0.111 or later. For the API key exfiltration (CVE-2026-21852), Claude Code before 2.0.65 is affected; upgrade to 2.0.65 or later, which covers both. Anthropic deferred network operations until after consent, blocked pre-approval MCP execution, and added stronger warning dialogs. Endpoints on standard auto-update already have the fixes; manually managed installs need an explicit upgrade. The durable control beyond patching is to inventory which endpoints run which Claude Code build and govern what project-file hooks and MCP servers are allowed to do. How does Anomity reduce exposure to this class of flaw? Anomity inventories hooks, MCP servers, and CLI configuration on every managed endpoint as part of the eight AI artifact types it tracks, so you can find Claude Code builds before 1.0.111 or 2.0.65 and the projects that register a SessionStart hook or set enableAllProjectMcpServers or ANTHROPIC_BASE_URL. On agents that expose a hook such as Claude Code PreToolUse, it returns allow, deny, or log on each tool call before it runs, so a pre-consent project-file action can be denied at the boundary. Every decision and configuration change lands in a queryable 90-day audit trail routed to your SIEM. ## Related [Advisory High ### OpenCode Server Cross-Site Upgrade Installs Attacker Packages - GHSA-632h-h47v-g4x4 A web page could make OpenCode's local server install an attacker's npm package via a cross-site form. No DNS rebinding needed. Fixed in 1.18.22. Anomity Research · Oct 2, 2026 · GHSA-632h-h47v-g4x4 (CVSS 7.5, no CVE)](https://anomity.ai/blog/opencode-cross-site-upgrade-rce-ghsa-632h-h47v-g4x4/) [Advisory Critical ### GitSpawn - Malicious .git Configs Make Coding Agents Run Attacker Code Manifold's GitSpawn (Sep 1 2026): malicious .git/config core.fsmonitor runs on git status/diff during agent context gather - outside sandbox, no approval. Patched in goose, Codex, Cursor, Claude Code; several agents still open. Anomity Research · Sep 14, 2026 · GitSpawn (Manifold, 2026-09-01); CVE-2026-72718 (goose), CVE-2026-19592 (Codex CLI), CVE-2026-71963 (Hermes)](https://anomity.ai/blog/gitspawn-malicious-git-config-coding-agent-rce/) [Guide ### When a Coding Agent Drops Your Database: Why It Happens and the Guardrails That Stop It Agents drop databases because they hold write credentials and migration tooling is destructive by design. The fix is credentials and deny-lists, not better prompts. Anomity Research · Aug 5, 2026 · 6 min](https://anomity.ai/blog/agents-destructive-database-operations-guardrails/) ## Structured data ```json { "@context": "https://schema.org", "@type": "TechArticle", "headline": "Claude Code Project-File RCE and API Token Exfiltration - CVE-2025-59536 / CVE-2026-21852", "description": "CVE-2025-59536 and CVE-2026-21852: a cloned repo's .claude/settings.json ran code and leaked the Anthropic API key before the Claude Code trust prompt.", "datePublished": "2026-02-25", "dateModified": "2026-02-25", "author": { "@type": "Organization", "name": "Anomity", "url": "https://anomity.ai/", "sameAs": [ "https://www.linkedin.com/company/anomity", "https://github.com/Anomity-ai", "https://www.wikidata.org/wiki/Q140763940" ] }, "publisher": { "@type": "Organization", "name": "Anomity", "url": "https://anomity.ai/", "sameAs": [ "https://www.linkedin.com/company/anomity", "https://github.com/Anomity-ai", "https://www.wikidata.org/wiki/Q140763940" ], "logo": { "@type": "ImageObject", "url": "https://anomity.ai/icon-512.png" } }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://anomity.ai/blog/claude-code-project-file-rce-token-exfil-cve-2025-59536/" }, "image": { "@type": "ImageObject", "url": "https://anomity.ai/assets/blog/covers/prompt-injection.jpg", "width": 1200, "height": 630 }, "articleSection": "AI Agent & CLI Security", "url": "https://anomity.ai/blog/claude-code-project-file-rce-token-exfil-cve-2025-59536/", "keywords": "Claude Code CVE-2025-59536, CVE-2025-59536, CVE-2026-21852 (GHSA-jh7p-qr78-84p7), Claude Code, CLI security, hooks, MCP, remote code execution, credential exfiltration, agentic AI security, CVE-2025-59536, CVE-2026-21852" } ``` ```json { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What is CVE-2025-59536 in Claude Code?", "acceptedAnswer": { "@type": "Answer", "text": "CVE-2025-59536 is a pre-consent code-execution flaw in Anthropic Claude Code, disclosed by Check Point Research and published October 3, 2025. A cloned but untrusted repository could ship a `.claude/settings.json` that registered a SessionStart hook, and the `enableAllProjectMcpServers` setting let MCP initialization commands run, before the startup trust dialog was even readable. The root cause was an initialization order that applied repository configuration before trust verification, so opening a hostile project ran attacker shell commands automatically. It is fixed in Claude Code 1.0.111. The hooks behavior was first reported July 21, 2025, and the full chain was publicly disclosed February 25, 2026." } }, { "@type": "Question", "name": "What is CVE-2026-21852 and how is it related?", "acceptedAnswer": { "@type": "Answer", "text": "CVE-2026-21852 (tracked as GHSA-jh7p-qr78-84p7, CVSS 5.3) is the credential-leak half of the same Check Point Research chain, published January 21, 2026. A malicious project could set `ANTHROPIC_BASE_URL` in its repository settings to an attacker-controlled endpoint. Because Claude Code applied that configuration before showing the trust prompt, it issued API requests to the attacker's server during project load and leaked the full Anthropic API key in plaintext. It shares the root cause with CVE-2025-59536: repository configuration applied ahead of consent. It is fixed in Claude Code 2.0.65, which defers all network operations until after the user confirms trust." } }, { "@type": "Question", "name": "Which Claude Code versions are affected and how do I fix this?", "acceptedAnswer": { "@type": "Answer", "text": "For the code execution and consent bypass (CVE-2025-59536), Claude Code before 1.0.111 is affected; upgrade to 1.0.111 or later. For the API key exfiltration (CVE-2026-21852), Claude Code before 2.0.65 is affected; upgrade to 2.0.65 or later, which covers both. Anthropic deferred network operations until after consent, blocked pre-approval MCP execution, and added stronger warning dialogs. Endpoints on standard auto-update already have the fixes; manually managed installs need an explicit upgrade. The durable control beyond patching is to inventory which endpoints run which Claude Code build and govern what project-file hooks and MCP servers are allowed to do." } }, { "@type": "Question", "name": "How does Anomity reduce exposure to this class of flaw?", "acceptedAnswer": { "@type": "Answer", "text": "Anomity inventories hooks, MCP servers, and CLI configuration on every managed endpoint as part of the eight AI artifact types it tracks, so you can find Claude Code builds before 1.0.111 or 2.0.65 and the projects that register a SessionStart hook or set enableAllProjectMcpServers or ANTHROPIC_BASE_URL. On agents that expose a hook such as Claude Code PreToolUse, it returns allow, deny, or log on each tool call before it runs, so a pre-consent project-file action can be denied at the boundary. Every decision and configuration change lands in a queryable 90-day audit trail routed to your SIEM." } } ] } ``` ```json { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://anomity.ai/" }, { "@type": "ListItem", "position": 2, "name": "Blog", "item": "https://anomity.ai/blog/" }, { "@type": "ListItem", "position": 3, "name": "Claude Code Project-File RCE and API Token Exfiltration - CVE-2025-59536 / CVE-2026-21852", "item": "https://anomity.ai/blog/claude-code-project-file-rce-token-exfil-cve-2025-59536/" } ] } ```