Tel Aviv, Israel, July twenty fourth, 2026, CyberNewswire
One week after disclosing that Anthropic’s Claude Tag Slack integration might be pushed by plain “@Claude” textual content, Tego AI as we speak printed a second piece of analysis on the Claude ecosystem. This one focuses on Claude Code, Anthropic’s agentic command-line coding software.
Cloning an atypical repository and beginning Claude Code could cause the software to learn a file from exterior the venture and embrace it within the mannequin’s first request, and not using a warning or approval immediate the person would acknowledge.
The method is atypical, and that’s a part of why it issues. A repository can commit a normal-looking instruction file, CLAUDE.md, whose @import directive factors to a symbolic hyperlink. When a developer clones the repository and begins Claude Code, the software follows the hyperlink to no matter file it resolves to, together with recordsdata effectively exterior the venture, and folds that file’s contents into the primary request it sends to the mannequin.
No software name fires, and no file-edit approval seems. The dialog Claude Code makes use of to catch out-of-project reads doesn’t seem both, as a result of it checks the in-repository hyperlink title, akin to ./hyperlink, slightly than the exterior file the hyperlink resolves to.
The entire supply mechanism is a repository file named hyperlink that GitHub itself labels as a symbolic hyperlink pointing to /and so on/passwd2, seen to anybody searching the repository.
“Context is no matter will get despatched to the mannequin, and the mannequin is a community endpoint like every other,” stated Tomer Niv, Head of Analysis at Tego AI. “So this isn’t a file that quietly sits in a immediate. Clone a repo, reply the identical ‘belief this folder?’ query you at all times reply, and a file from exterior that repo can go away your machine on the primary request, with no code execution, no cooperation from the mannequin, and no server the attacker has to run.”
The result’s that the out-of-project file’s contents seem contained in the request physique Claude Code sends when the session begins. The information leaves the native machine as a part of the outbound request, slightly than remaining solely in native mannequin context.
Anthropic has already fastened this underlying class of flaw twice. What makes the brand new report notable is the place the flaw sits, not that the sample is new.
The identical failure, a safety test studying one path whereas the filesystem follows a symbolic hyperlink to a different, beforehand appeared in Claude Code and was fastened accurately in CVE-2025-59829 and CVE-2026-25724. Each have been reported via HackerOne and resolved within the permission subsystem.
Tego AI’s analysis reveals that the identical defect remained current on a 3rd code path, the startup reminiscence loader, which these fixes by no means reached. That path can also be the one which locations what it finds onto the community earlier than the mannequin has taken any motion.
The technical write-up additionally paperwork {that a} repository-committed settings file can redirect Claude Code’s outbound endpoint to a number chosen by the repository writer, a individually recognized conduct. The uncovered file solely must be readable by the developer’s personal account. That may be a sensible situation in CI runners, containers, and standardized developer photos, the place delicate file paths are sometimes predictable.
Tego AI’s level is about that safety boundary slightly than a single bug. The corporate reported the problem to Anthropic via HackerOne in July 2026, and Anthropic closed it as Informative.
Anthropic’s rationale was constant and clearly acknowledged: below the Claude Code menace mannequin, the “belief this folder” dialog is the safety boundary, and accepting it already grants a venture broad learn, edit, and execute entry. Tego AI doesn’t dispute that Anthropic utilized its acknowledged mannequin persistently.
“We perceive the mannequin. Our disclosure is an argument about its phrases,” Niv stated. “A single ‘belief this folder’ click on is being requested to hold an unlimited quantity of weight, at least knowledgeable second potential, earlier than you’ve got seen something the repository does. It can’t inform the distinction between ‘run my code’ and ‘learn my SSH key and mail it out,’ and in lots of actual setups that click on was inherited from a dad or mum listing and by no means really proven for the repository in query. As enterprises undertake AI coding brokers, that’s precisely the boundary they want to have the ability to cause about.”
The disclosure continues a theme in Tego AI’s analysis: for enterprise AI brokers, the unresolved query is authorization, that means who, or what, is allowed to instruct the agent and attain its knowledge and related methods. The Claude Tag analysis raised that query about an inbound Slack message. This analysis raises it about an atypical Git clone.
Tego AI notes that symbolic-link assaults are many years outdated and that Anthropic has repeatedly hardened Claude Code in opposition to them in good religion. The corporate printed the write-up so customers and safety groups can cause precisely about what “belief this folder” grants in follow.
Tego AI confirmed the conduct in opposition to Claude Code v2.1.x.
The total technical report is accessible at: https://tego.ai/weblog/a-hidden-project-link-can-make-claude-code-silently-send-your-files-to-an-attacker
About Tego AI
Tego AI is a cybersecurity firm growing runtime safety and management expertise for enterprise AI brokers. Its platform helps organizations monitor agent exercise and cease unauthorized or dangerous actions earlier than brokers entry delicate knowledge or related methods.
The corporate operates in stealth. That is its second public safety disclosure in per week. In response to Tego AI, there’s extra to come back.
Contact
CTO
Tal Melamed
Tego AI
[email protected]
