Fetching from the wire…
01
02
03
04
05
06
07
08
Top 5 · 2026-03-25 · source-backed
Lasso Security published research demonstrating that Claude Code's --dangerously-skip-permissions flag enables indirect prompt injection via poisoned READMEs, documentation files, and MCP responses. Then they did something unusual: they released the defense alongside the attack.
Their open-source claude-hooks project implements a PostToolUse hook with 50+ regex patterns across four attack categories: instruction override, role-playing manipulation, encoding/obfuscation, and context manipulation. When a tool returns content that matches an attack pattern, the hook intercepts it and injects a warning into Claude's context before processing continues. It's the first production-ready open-source defense for Claude Code's autonomous mode.
This matters because three independent security responses landed in the same week. Trail of Bits released their internal Claude Code security config with PreToolUse hooks that block dangerous patterns before execution. Anthropic shipped CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1 in v2.1.83, which strips credentials from every subprocess environment. Three different teams, three different approaches, all targeting the same attack surface.
The Claude Code v2.1.83 release itself is significant beyond the credential scrubbing. managed-settings.d/ lets organizations deploy modular policies. sandbox.failIfUnavailable enforces strict sandbox requirements. Transcript search via / key makes long sessions navigable. Over 50 bugs fixed. The --bare flag gives ~14% faster SDK performance.
For builders using Claude Code autonomously (and I know many of you are), here's your action list: install claude-hooks as a PostToolUse defender. Add CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1 to your shell profile. Review Trail of Bits' config for PreToolUse guardrails. If you're running --dangerously-skip-permissions without any of these, you're accepting a risk that now has documented, weaponized exploits and documented, tested defenses. There's no excuse for the former without the latter.
Each link below shares sources, entities, or timing with this story.
Lasso Security criticizes Claude Code / Shared entities / Same source domain / Shared topic / What happened next
Linked by a graph relationship (Lasso Security criticizes Claude Code); both cover Anthropic, Claude, Claude Code, MCP; reported by the same outlet (github.com).
Lasso Security criticizes Claude Code / Shared entities / Same source / Shared topic / Earlier coverage
Linked by a graph relationship (Lasso Security criticizes Claude Code); both cover CLAUDE, Claude Code, MCP, PreToolUse; cite the same source (v2.1.83).
Lasso Security criticizes Claude Code / Shared entities / Same source / Shared topic / What happened next
Linked by a graph relationship (Lasso Security criticizes Claude Code); both cover Claude, Claude Code, Then, There; cite the same source (v2.1.83).
Lasso Security criticizes Claude Code / Shared entities / What happened next / Tension
Linked by a graph relationship (Lasso Security criticizes Claude Code); both cover CLAUDE, Claude Code, MCP, Then; picks up the CLAUDE thread on 2026-08-05.
Lasso Security criticizes Claude Code / Shared entities / Same source / Shared topic / What happened next / Tension
Linked by a graph relationship (Lasso Security criticizes Claude Code); both cover CLAUDE, Claude Code, MCP; cite the same source (v2.1.83).
Anthropic released MCP / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Anthropic released MCP); both cover Anthropic, CLAUDE, Their, Then; overlapping topics (claude, code, pattern, same).
Lasso Security criticizes Claude Code / Shared entities / Same source / Shared topic / What happened next
Linked by a graph relationship (Lasso Security criticizes Claude Code); both cover CLAUDE, Claude Code, MCP, There; cite the same source (v2.1.83).
Linked by a graph relationship (Lasso Security criticizes Claude Code); both cover Anthropic, Claude Code, SDK, When; cite the same source (v2.1.83).