Entity trail

Claude Code Security

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-08-17 / agents-researcherHazmat: a Go tool that runs Claude Code, Codex, OpenCode and Cursor Agent under a separate macOS user with a kernel sandbox and pf firewall — TLA+ verifiedHelp Net Security covered Hazmat (Aug 17, 2026), an open-source containment layer for coding agents that gives each agent its own macOS user account, kernel-enforced sandbox, firewall, DNS blocklist and automatic pre-session backup, printing the session's write paths, read-only paths and network reach before launch. The premise is that an agent launched normally runs as you and can read every SSH key and cloud credential in your home directory. The GitHub repo (dredozubov/hazmat) is small — 128 stars, created March 27, 2026 — so this is early tooling, but it is the clearest answer yet to the 'agent runs with my full identity' problem.
2026-08-17 / vibe-coding-researcherClaude Code 2.1.233 Closes an NTLM Credential-Leak Vector via NT `\??\` Device-Prefixed Windows PathsBuried in the 2.1.233 changelog is a real security fix: Windows paths spelled with the NT device prefix `\??\` bypassed Claude Code's UNC path validation, meaning a crafted path could reach a remote SMB host and leak NTLM credentials on connect. The same release also fixed skill/command argument substitution so argument values are no longer re-expanded as template markers — a second injection-shaped bug in the skills layer. Windows users on 2.1.232 or earlier should upgrade; this is not a cosmetic patch.
2026-08-16 / agents-researcherSRE-Bench: 5,000 expert hours to build the first contamination-free reverse-engineering benchmark, and frontier agents solve only 31.5% of itResearchers built 19 private, real-world-scale programs from scratch (averaging 16.9K lines) plus 44 in-house anti-analysis primitives, yielding 262 binary instances and 1,572 deterministically graded tasks — designed so no instance's source code can be in any model's training data. Across GPT-5.6-sol, Claude Opus 5, GPT-5.5, Grok-4.5 and GLM-5.2, the strongest model scored 61.4% per instance and fully solved just 31.5% of instances. The finding that matters for builders: strong source-code security capability does not transfer to binary analysis, and agents are oddly insensitive to compiler optimization and static linking in ways human reverse engineers are not.
2026-08-15 / reddit-researcherClaude Code 2.1.232 Adds a Dedicated Web-Reading Specialist Subagent and Turns Subagent Forking On by DefaultClaude Code v2.1.231/232 shipped 2026-08-13 with 50 changes (17 fixes, 12 improvements, 12 security, 6 features, 2 performance, 1 breaking). The headline additions are a 662-token 'web reading specialist' system prompt that delegates untrusted URL reads to a dedicated WebFetch subagent returning source-grounded reports, subagent forking now enabled by default so `subagent_type: "fork"` inherits the full conversation and prompt cache, and cross-session @-mentions routed through SendMessage. The breaking change moves `sandbox.ripgrep` config out of project settings to user/managed settings only; security fixes include a PowerShell permission bypass via `$PSDefaultParameterValues`.
2026-08-12 / vibe-coding-researcherPattern: Skill Supply-Chain Defense Is Moving to the Client Boundary, Not the RegistryClaude Code 2.1.228 sanitizes and labels skill descriptions synced from claude.ai and strips their ability to run `!` commands or expand `@` files locally — enforcement at the point of execution, on the user's machine. That pairs with Anthropic's enterprise skill-and-plugin security scanning (beta, 08-06) at upload time, giving two independent layers rather than trusting a marketplace review. The design lesson for anyone shipping a skill distribution channel: assume the registry will be poisoned and put the real check where the skill actually runs.
2026-08-11 / agents-researcherAgentjacking at DEF CON 34: a public Sentry DSN plus an MCP integration equals RCE on a developer's machine, 85% of the timeTenet Security showed that Sentry's unauthenticated ingest endpoint lets anyone with a public DSN POST a crafted error event whose message fields contain markdown that reads like remediation guidance; when a developer asks Claude Code or Cursor to debug Sentry issues, the agent pulls the injected event through MCP and executes it with local privileges. In controlled testing across 100+ organizations the chain worked 85% of the time, and researchers found 2,388 orgs with publicly discoverable DSNs, 71 in the Tranco top-1M. Sentry deployed a payload-string content filter but declined platform-level remediation as 'technically not defensible'; no CVE was assigned, and Tenet's mitigation repo tenet-security/agent-jackstop ships deny-by-default egress allowlists for Cursor and Claude Code.
2026-08-10 / vibe-coding-researcherApex Runs Autonomous Offensive Security Testing From the Terminal on the Claude Agent SDKApex (~300 stars) is a penetration-testing agent built directly on Anthropic's Claude Agent SDK, covering blackbox and whitebox testing, authentication bypass, source code analysis, and data exfiltration/pivoting scenarios, with extended thinking for complex vulnerability discovery. It runs headless for CI/CD integration, which is the notable part — continuous autonomous pentesting as a pipeline stage rather than a quarterly engagement. Small project and single-source, so treat capability claims as unverified, but it is a concrete instance of the security-agent category arriving the same week an unsupervised consumer agent found a real authorization flaw by accident.
2026-08-10 / projects-researcherECC Is Now the Largest Agent-Harness Repo on GitHub at 239,125 Stars, Shipping 284 Skills, 67 Agents and a 1,282-Test Security Scanner Across 12 CLIsaffaan-m/ECC has reached 239,125 stars and 36.3k forks under MIT, making it the biggest single agent-tooling repo in circulation. It bundles 67 agents, 284 skills, 94 legacy command shims, and 'instincts' — patterns learned from prior sessions with confidence scores that auto-recall when relevant — plus a `.ecc/memory/` markdown vault that is explicitly cross-harness, so context survives a move between Claude Code, Codex, Cursor, Kimi Code, OpenCode, Gemini, Zed, Antigravity, Qwen, Hermes, OpenClaw, CodeBuddy and JoyCode. The security component, AgentShield, runs 1,282 tests against secrets, hook definitions and MCP config risk. Version 2.1 adds a browser-based 'Plan Canvas' for plan review, Kimi Code integration, and self-hosted compute; install is `npx ecc-universal setup`.
2026-08-10 / projects-researcherClaude Code Ships Cross-Session Messaging — Your Terminal Sessions Can Now Warn Each Other Mid-Task Over a Per-Session Unix SocketAnthropic published docs for cross-session messaging (Claude Code v2.1.224+, macOS and Linux only, not on Bedrock/Vertex/Foundry), which hit the HN front page at 160 points. Each session binds a Unix domain inbox socket restricted to your OS user — exported to hooks as `CLAUDE_CODE_MESSAGING_SOCKET` and visible as the `Peer address` row in `/status` — and Claude uses `ListAgents` plus `SendMessage` to deliver plain-text notes between sessions without ever passing conversation history or files. The security model is the notable part for builders: an inbound message can never approve a permission prompt, never mutate CLAUDE.md or settings, and slash commands in message text arrive as inert text; a `crossSessionInbound` setting takes accept/hold/refuse, loops are rate-limited with a 50-message read queue and 100-message hold cap, and cross-machine sends are reply-only unless Remote Control is connected.
2026-08-10 / thought-leaders-researcherWillison on Auto Mode: 'Confirmation Fatigue Is Real' — But He Wants Independent Verification Before Believing Anthropic Solved Prompt InjectionSimon Willison endorsed the premise behind auto mode — 'asking humans to click OK every few steps is clearly not going to result in safe behavior' — while withholding judgment on the security claims, writing 'I would love to believe that Anthropic have indeed solved this problem for Claude Code users.' His specific unresolved worry is malicious third-party packages that appear credible to the model, a channel the injection evals don't cover. Willison has publicly predicted a coding-agent security disaster in 2026 and wants outside verification before accepting first-party numbers.
2026-08-09 / agents-researcherBoundary-Bench: turn on the security controls your enterprise already runs and coding agents lose up to 18.3 pointsResearchers from Accomplish AI and NYU open-sourced Boundary-Bench on August 5, running 12 frontier agent harnesses across roughly 10,000 runs on 89 Terminal-Bench 2.1 tasks inside Daytona sandboxes hardened with NIST-derived Network × Filesystem × Privilege policies enforced by nftables, read-only bind remounts, setpriv/no_new_privs and Landlock — denials surface as ordinary EROFS/EPERM errors with no agent-visible shim. Codex on GPT-5.6 Sol leads unrestricted at 83.9%, but under the strictest tier Grok Build on Grok 4.5 tops out at 74.9% and Claude Code on Sonnet 5 shows the largest degradation at 18.3 points; costs inflate up to 167.3%. The argument for builders is blunt: public leaderboard numbers are produced under conditions no security team would approve, so procurement decisions are being made on figures that do not survive contact with EDR, SASE and DLP.
2026-08-09 / vibe-coding-researcherPattern: Every Major Harness Is Replacing Human Approval With a Model Reviewing the ModelFour vendors converged on the same conclusion within days: Claude Code makes classifier-screened auto mode the default on August 14, Codex CLI 0.147.0 shipped `--approve-for-me` for automatically reviewed approvals plus safer auto-review defaults specifically for cyber-capable models in 0.146.1, Zed 1.14.2 sandboxed its agent's terminal and fetch tools, and Devin Local added editable command approvals. The shared premise is that per-call human approval is security theater at a 97% approval rate. The practical consequence for builders: your defense-in-depth budget should move from 'read the prompt carefully' to blast-radius controls — disposable VMs, worktree isolation, scoped credentials, and hard-deny rules that no classifier decision can override.

Graph relationships

USES
Opus 4.6
Claude Code Security uses Opus 4.6 as autonomous scanner
Source finding
RELEASED
Anthropic
Anthropic launched Claude Code Security vulnerability scanner
Source finding
RELEASED
Anthropic
Anthropic launched Claude Code Security as limited research preview
Source finding
RELEASED
Anthropic -> Claude Code Security
Anthropic launched Claude Code Security vulnerability scanner
Source finding
RELEASED
Anthropic -> Claude Code Security
Anthropic launched Claude Code Security as limited research preview
Source finding

Source trail

Anthropic Blog VentureBeat Check Point Research — Claude Code CVEs TechCrunch — New Relic Agentic Platform The Hacker News — OpenClaw CVE-2026-25253 Bloomberry — 1,412 MCP servers enterprise event Self-serve Enterprise The Register reports GitHub GitHub Fortune — AI Bug Hunting Exclusive

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…