Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-03-20 · source-backed
Check Point Research disclosed CVE-2025-59536 and CVE-2026-21852 — two vulnerabilities that weaponize Claude Code's project configuration system against its users. This matters because an Agents Anonymous survey this week showed 90% of practitioners at their SF meetup use Claude Code. The attack surface is massive.
The first vector: a malicious .claude directory in a cloned repository can set ANTHROPIC_BASE_URL to redirect all API traffic — including full authorization headers with your API key — to an attacker-controlled server. The redirect happens before the user sees a trust dialog. You clone a repo, open it in Claude Code, and your API credentials are exfiltrated in plaintext before you've read a single line of code.
The second vector exploits Claude Code's hook execution model. A crafted CLAUDE.md file can inject arbitrary shell commands into the agent lifecycle — commands that execute with your user permissions the instant Claude Code opens the project. RCE via documentation. Not via exploit code. Via a markdown file.
The defense is behavioral, not technical: treat .claude/ project files like executable code in your threat model. Never open unreviewed repositories in Claude Code without first inspecting the .claude directory and any CLAUDE.md files. If you're cloning repos from untrusted sources — and GitHub forks from strangers count as untrusted — audit the project configuration files before launching your agent.
This converges with the bot PR finding above in an ugly way. If bots are submitting PRs that introduce or modify CLAUDE.md files in popular repos, and those PRs merge without adequate review, the next developer who clones and opens that repo in Claude Code is compromised. The supply chain attack doesn't require the victim to install anything unusual. They just have to open a project in the tool 90% of practitioners already use daily.
Each link below shares sources, entities, or timing with this story.
Claude Code uses MCP / Shared entities / Same source / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code uses MCP); both cover Check Point Research, Claude Code, CVE; cite the same source (Check Point Research).
Linked by a graph relationship (Claude Code uses MCP); both cover Check Point Research, CVE, RCE; cite the same source (Check Point Research).
Aonan Guan criticizes Claude Code / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Aonan Guan criticizes Claude Code); both cover Claude Code, CVE, GitHub, PRs; overlapping topics (agent, attack, claude, code).
Claude Code competes with Cursor / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Claude Code competes with Cursor); both cover Claude, Claude Code, GitHub, PRs; overlapping topics (agent, claude, code, model).
Claude Code uses MCP / Shared entities / Same source / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code uses MCP); both cover Check Point Research, CVE, Never; cite the same source (Check Point Research).
Claude Code uses Opus / Shared entities / Shared topic / What happened next / Tension
Linked by a graph relationship (Claude Code uses Opus); both cover Claude, Claude Code, GitHub; overlapping topics (agent, claude, code, command, repo).
Boris Cherny uses Claude Code / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Boris Cherny uses Claude Code); both cover Claude Code, GitHub, PRs; reported by the same outlet (x.com).
Check Point criticizes Claude Code / Shared entities / Same source / Shared topic / What happened next
Linked by a graph relationship (Check Point criticizes Claude Code); both cover Check Point Research, Claude Code, CVE; cite the same source (Check Point Research).