Tego AI has disclosed a second security issue affecting Anthropic’s Claude ecosystem within a single week, this time targeting Claude Code vulnerability mechanisms. The command-line coding tool can be manipulated to read and transmit files from outside project directories without displaying recognizable warnings or approval prompts to users.
How Does the Symbolic Link Attack Work?
The vulnerability exploits a standard feature: repositories can commit an instruction file named CLAUDE.md containing an @import directive that points to a symbolic link. When developers clone the repository and launch Claude Code, the tool follows this link to whatever file it resolves to, including files located well outside the project boundaries. The contents of these external files are incorporated into the first request sent to the model without triggering any tool calls or file-edit approval prompts.
The security dialog designed to catch out-of-project reads fails because it checks the in-repository link name, such as ./link, rather than examining the external file the link actually resolves to. The entire delivery mechanism relies on a repository file that GitHub itself labels as a symbolic link pointing to paths like /etc/passwd2, visible to anyone browsing the repository.
What Makes This Discovery Significant?
According to Tomer Niv, Head of Research at Tego AI, the issue represents a fundamental authorization problem. “Context is whatever gets sent to the model, and the model is a network endpoint like any other,” Niv explained. “Clone a repo, answer the same ‘trust this folder?’ question you always answer, and a file from outside that repo can leave your machine on the first request, with no code execution, no cooperation from the model, and no server the attacker has to run.”
The exposed file only needs to be readable by the developer’s own account, a realistic condition in CI runners, containers, and standardized developer images where sensitive file paths are often predictable. The technical write-up also documents that a repository-committed settings file can redirect Claude Code’s outbound endpoint to a host chosen by the repository author.
Has Anthropic Fixed Similar Issues Before?
Anthropic has previously addressed this underlying class of flaw twice. The same failure pattern appeared in Claude Code and was correctly fixed in CVE-2025-59829 and CVE-2026-25724, both reported through HackerOne and resolved in the permission subsystem. However, Tego AI’s research demonstrates that the same defect remained present on a third code path: the startup memory loader, which those previous fixes never reached.
Tego AI reported the issue to Anthropic through HackerOne in July 2026. Anthropic closed it as Informative, maintaining that under the Claude Code threat model, the “trust this folder” dialog serves as the security boundary, and accepting it already grants broad read, edit, and execute access. Tego AI confirmed the behavior against Claude Code v2.1.x.
Source: Cybersecurity News