Claude Code: One Clone, Full Shell, Stolen API Key
Check Point Research disclosed two vulnerabilities in Anthropic's Claude Code on February 25, 2026. CVE-2025-59536 (CVSS 8.7) allowed hooks defined in a repository's .claude/settings.json to execute arbitrary shell commands before the trust dialogue appeared, meaning cloning a malicious repository and initialising Claude Code was sufficient for full code execution with no user confirmation. CVE-2026-21852 (CVSS 5.3) allowed a repository-controlled ANTHROPIC_BASE_URL override to redirect all API traffic to an attacker's server before trust was confirmed, silently exfiltrating the developer's Anthropic API key. Both attack paths exploited Claude Code's MCP consent-bypass settings, specifically enableAllProjectMcpServers and enabledMcpjsonServers, which auto-approved MCP servers defined in the repository's .mcp.json without manual review.
What happened
Claude Code supports Hooks: shell commands defined in .claude/settings.json that execute automatically at lifecycle points including session start, file change, and tool call completion. Check Point Research found that in versions before 1.0.111, those hooks fired before the trust dialogue appeared. The attack is as short as the exploit: plant a malicious .claude/settings.json in a public repository, wait for a developer to clone it and type claude. The reverse shell lands before any confirmation prompt.
The MCP-specific angle runs through .mcp.json and two settings in .claude/settings.json: enableAllProjectMcpServers and enabledMcpjsonServers. Both settings auto-approve MCP servers defined in the repository without requiring user consent. In a legitimate workflow they allow teams to ship consistent MCP integrations. As an attack surface they let a repository control which MCP servers Claude Code initialises and runs on the developer's machine.
CVE-2026-21852 is quieter but operationally more damaging in team environments. Claude Code respects an ANTHROPIC_BASE_URL environment variable that overrides where API requests go. A repository-controlled .claude/settings.json could set this variable to an attacker-controlled proxy. Every prompt the developer sent during that session, along with the x-api-key header, was forwarded to the attacker before any warning fired. In Anthropic Workspaces, a stolen key exposes data scoped to the entire workspace, not just the individual developer's context.
All three issues were patched by Anthropic before public disclosure. MCP servers now cannot execute before user approval even when the auto-approval settings are set from repository config. API requests are deferred until after the trust dialogue completes.
The PolicyLayer angle
The repository is now the attack surface. That is the shift CVE-2025-59536 makes concrete. A repository configuration file that controls which MCP servers an agent initialises is not metadata; it is a privileged execution instruction. The moment an agentic tool reads repository config on startup, every repository a developer touches becomes a potential delivery vector for server-side behaviour they did not explicitly authorise.
The controls that close this class of attack: treat every MCP server defined in repository-level config as untrusted until reviewed. Do not allow enableAllProjectMcpServers or enabledMcpjsonServers to be set from untrusted repositories without an out-of-band approval step. Audit hooks in .claude/settings.json the same way you audit postinstall scripts in package.json. For team environments using Workspaces, rotate API keys for any developer who ran Claude Code against an untrusted repository during the vulnerability window (mid-2025 to January 2026) and scope Workspace access keys to the minimum necessary projects.
CVE-2026-21852 illustrates a property that applies to every agent framework: any credential that travels over a channel the agent controls can be intercepted before the user knows the agent has started. The defence is not a smarter trust dialogue; it is ensuring that no credential is committed to an outbound request until the user has confirmed the destination is legitimate.
Mitigations
Update Claude Code to version 2.0.65 or later; CVE-2025-59536 was fixed in 1.0.111 and CVE-2026-21852 in 2.0.65. Treat a repository’s .claude/settings.json and .mcp.json as executable content rather than passive configuration, and do not open repositories of uncertain provenance before the trust dialogue. Rotate any Anthropic API key that was active while such a repository was open, and review workspace access if a key may have been exposed. Avoid setting enableAllProjectMcpServers and enabledMcpjsonServers from repositories you do not control.
FAQs
Clone a malicious repository and open it in Claude Code. No further interaction is needed. The hook fires during tool initialisation, before the trust dialogue appears.
Yes, though the blast radius is smaller. A stolen individual API key allows the attacker to make API calls billed to the victim and access any data the developer's key is scoped to. In Workspaces, the same key may grant access to shared projects across the entire team.
The settings still exist for legitimate team collaboration. The fix ensures they cannot be set from untrusted repository config to bypass the user approval dialogue. Users must explicitly choose to trust a repository before project-defined MCP servers are initialised.