Claude collaboration tools left the door wide open to remote code execution

Anthropic fixed the flaws – but the AI-enabled attack surfaces remain

Security vulnerabilities in Claude Code could have allowed attackers to remotely execute code on users' machines and steal API keys by injecting malicious configurations into repositories, and then waiting for a developer to clone and open an untrustworthy project.

Check Point Software researchers found and reported all three flaws to Anthropic, which issued fixes for all and CVEs for two. Still, the bug hunters say, the issues illustrate a worrisome supply chain threat as enterprises incorporate AI coding tools like Claude into their development processes and essentially turn configuration files into a new attack surface.

"The ability to execute arbitrary commands through repository-controlled configuration files created severe supply chain risks, where a single malicious commit could compromise any developer working with the affected repository," Check Point researchers Aviv Donenfeld and Oded Vanunu said in a Wednesday report.

Anthropic, the AI company that developed Claude Code, did not respond to The Register's requests for comment.

The three security vulnerabilities stem from Claude's design, which is intended to make it easier for development teams to collaborate. The AI coding tool enables this by embedding project-level configuration files (.claude/settings.json file) directly within repositories, so that when a developer clones a project, they automatically apply the same settings used by their teammates.

Any contributor with commit access can modify these files. The researchers found that cloning and opening a malicious repository sometimes allowed them to bypass built-in safeguards and trigger hidden commands and execute malicious code.

Abusing Hooks for RCE

The first of the three flaws involved abusing Claude's Hooks feature to achieve remote code execution. Hooks are user-defined shell commands that execute at various points in the tool's lifecycle, ensuring that specific, predefined actions run when predetermined conditions are met, instead of allowing the model to choose.

Because Hooks are defined in .claude/settings.json, the repository-controlled configuration file, anyone with commit access can define hooks that will execute shell commands on every other collaborator's machine when they work on the project. Plus, Claude doesn't require any explicit approval before executing these commands – so the researchers abused this mechanism to open a calculator app when someone opened the project.

While a bash script to open a calculator is hardly malicious, it's still remote code execution. And as the team demonstrated in a video: "An attacker could configure the hook to execute any shell command – such as downloading and running a malicious payload" like a reverse shell.

Check Point reported the malicious hooks flaw to Anthropic on July 21, 2025, and the AI maker implemented the final fix about a month later, publishing this GitHub Security Advisory GHSA-ph6w-f82w-28w6 on August 29.

MCP consent bypass bug

The second vulnerability also allows RCE – this time by abusing MCP consent bypass.

Claude integrates with external tools using Model Context Protocol (MCP), and MCP servers can also be configured in the same repository via .mcp.json configuration file. Thanks to the earlier disclosure and Anthropic's fix, the researchers ran into warning prompts explicitly requiring user approval before executing commands in .mcp.json.

So they found a workaround: two repository-controlled configuration settings that could override safeguards and automatically approve all MCP servers.

"Starting Claude Code with this configuration revealed a severe vulnerability: our command executed immediately upon running Claude – before the user could even read the trust dialog," the Check Point duo wrote.

Again, they stuck with the calculator app, but also produced a video demonstrating how this vulnerability can be exploited to remotely execute a reverse shell and completely compromise a victim's machine.

The researchers reported this second vulnerability to Anthropic on September 3, 2025, Anthropic fixed the bypass vulnerability later that month, and published CVE-2025-59536 on October 3.

API key theft

Attackers can exploit the third flaw for API key theft. This one has to do with how Claude used an API key to communicate with Anthropic's services. One variable, ANTHROPIC_BASE_URL, controlled the endpoint for all Claude API communications, and while it's supposed to point to Anthropic's servers, it can be overridden in the project's configuration files to instead point to attacker-controlled servers.

The researchers configured ANTHROPIC_BASE_URL to route through their local proxy, and watched all Claude Code's API traffic in real time. Every one of Claude's calls to Anthropic servers "included the authorization header – our full Anthropic API key, completely exposed in plaintext," they wrote.

An attacker could abuse this trick to redirect traffic and steal a developer's active API key. It's important because the API includes a feature called Workspaces to help developers manage multiple Claude deployments by allowing multiple API keys to share access to the same cloud-based project files. Files are connected to the workspace – not the single key – and any API key belonging to the workspace also has visibility into any of the workspace's stored files.

This gave the researchers the ability to upload files to the shared workspace – but did not allow downloads. According to Claude's documentation, users can only download files created by skills or the code execution tool.

"Since files generated by Claude's code execution tool are marked as downloadable, we explored whether the attacker could simply ask Claude to regenerate an existing file using the stolen API key," Check Point’s Donenfeld and Vanunu wrote. "If successful, this would convert a non-downloadable file into a workspace artifact that is eligible for download."

Cloning and then downloading the file worked, and thus confirmed that a miscreant using a stolen API key could gain complete read and write access to all workspace files: deleting or changing sensitive files or even uploading malicious files to poison the workspace or exceed the 100 GB storage space quota.

Check Point reported the API key extraction bug to Anthropic on October 28, 2025, and the vendor immediately issued a fix. Later, on January 21, Anthropic published CVE-2026-21852.

As the security team noted: "The integration of AI into development workflows brings tremendous productivity benefits, but also introduces new attack surfaces that weren't present in traditional tools." ®