How the Attack Works

The vulnerability turns on a simple but critical oversight in Claude Code's memory loader:

1. A malicious repository contains a normal-looking CLAUDE.md file with an @import directive pointing to an in-repo file — for example, @./link .
2. That file is a Git-stored symbolic link (mode 120000 in Git) pointing to a target outside the repository, such as /etc/passwd or ../../../../home/user/.ssh/id_rsa. Git preserves symlinks when cloning .
3. When a developer clones the repo and launches Claude Code, the memory loader reads CLAUDE.md and encounters the @./link import. It checks whether the lexical path (./link) is inside the project — it is — so the import is classified as "internal" and no external-import approval dialog fires .
4. The loader then follows the symlink to the actual target file outside the project, reads its contents, and places them into the model's initial context window .
5. The content leaves the machine on the first outbound request to Anthropic's API — before the model has taken any action and without any visible tool call. The user sees no warning .
6. Optionally, a separately known ANTHROPIC_BASE_URL setting in the repo can redirect the outbound endpoint to a server the attacker controls, completing the exfiltration .

The novel finding is not that Claude Code follows symlinks — that is documented and intentional. The novel finding is the consent bypass: the external-import check runs against the unresolved path, the read operates on the resolved path, and the memory loader never received the symlink-resolution fix that was applied to Claude Code's permission subsystem in two prior CVEs .

Anthropic's Response

Tego AI reported the issue through HackerOne in July 2026. Anthropic closed the report as "Informative" — meaning it did not treat it as a security vulnerability under its current threat model .

Anthropic's rationale: under Claude Code's threat model, the "trust this folder" dialog is the security boundary. Accepting that dialog already grants the project broad read, edit, and execute access. Tego AI does not dispute that Anthropic consistently applies this model, but argues the finding still matters because the data leaves the machine automatically, silently, and outside the user's awareness .

Notably, the same symlink-vs.-security-check failure pattern had been fixed twice before in Claude Code's permission subsystem:

• CVE-2025-59829 (fixed September 2025): symlink bypass of deny rules in file permissions
• CVE-2026-25724 (fixed January 2026): same pattern again, deny-rule bypass via symlinks

Both prior fixes resolved the symlink before checking permissions — but that fix was never applied to the memory loader code path .

Broader Pattern: Claude Ecosystem and AI Coding Tool Security

Tego AI's disclosure is the second Claude ecosystem flaw in a week. On July 14, 2026, Tego disclosed that Claude Tag's Slack integration could be triggered by plain @Claude text in any message, potentially enabling unauthorized enterprise actions .

Beyond Tego's work, Claude Code has accumulated at least 28 CVEs in roughly one year of existence, including:

• Two CVSS 10.0 critical sandbox escapes: CVE-2026-39861 (symlink sandbox escape) and CVE-2026-25725 (settings.json sandbox bypass)
• CVE-2026-46406 (June 2026): the /copy command wrote responses to a hardcoded world-readable temp path /tmp/claude/response.md, letting any local user read secrets
• Check Point Research (February 2026): critical flaws (CVE-2025-59536, CVE-2026-21852) enabling RCE and API key theft via malicious repo-level configuration files

Cross-industry research shows this is not unique to Anthropic:

• GhostApproval (Wiz, July 2026): Symlink flaws in six AI coding assistants (Amazon Q Developer, Anthropic, Cursor, Google Gemini, GitHub Copilot, Vercel) let a booby-trapped repo make the tool write to a sensitive file while the user approves writing to a harmless one
• SymJack (Adversa AI, May 2026): A single symlink-hijack attack achieving RCE across six products (Claude Code, Gemini CLI, Cursor, Copilot, Grok Build, Codex CLI). The user approves a file copy; the kernel writes somewhere else
• TrustFall (Adversa AI, May 2026): Repo-defined MCP servers execute automatically once the user accepts the folder trust prompt

The underlying architectural tension is consistent across the industry: AI coding agents need broad filesystem, shell, and network access to be useful — but that elevated access is the same privilege an attacker needs. Every sandbox escape, path traversal, and trust-dialog bypass stems from this same challenge . The attack surface is not shrinking; new features add new vectors faster than existing ones are patched.

How the Attack Works

The vulnerability turns on a simple but critical oversight in Claude Code's memory loader:

1. A malicious repository contains a normal-looking CLAUDE.md file with an @import directive pointing to an in-repo file — for example, @./link .
2. That file is a Git-stored symbolic link (mode 120000 in Git) pointing to a target outside the repository, such as /etc/passwd or ../../../../home/user/.ssh/id_rsa. Git preserves symlinks when cloning .
3. When a developer clones the repo and launches Claude Code, the memory loader reads CLAUDE.md and encounters the @./link import. It checks whether the lexical path (./link) is inside the project — it is — so the import is classified as "internal" and no external-import approval dialog fires .
4. The loader then follows the symlink to the actual target file outside the project, reads its contents, and places them into the model's initial context window .
5. The content leaves the machine on the first outbound request to Anthropic's API — before the model has taken any action and without any visible tool call. The user sees no warning .
6. Optionally, a separately known ANTHROPIC_BASE_URL setting in the repo can redirect the outbound endpoint to a server the attacker controls, completing the exfiltration .

The novel finding is not that Claude Code follows symlinks — that is documented and intentional. The novel finding is the consent bypass: the external-import check runs against the unresolved path, the read operates on the resolved path, and the memory loader never received the symlink-resolution fix that was applied to Claude Code's permission subsystem in two prior CVEs .

Anthropic's Response

Tego AI reported the issue through HackerOne in July 2026. Anthropic closed the report as "Informative" — meaning it did not treat it as a security vulnerability under its current threat model .

Anthropic's rationale: under Claude Code's threat model, the "trust this folder" dialog is the security boundary. Accepting that dialog already grants the project broad read, edit, and execute access. Tego AI does not dispute that Anthropic consistently applies this model, but argues the finding still matters because the data leaves the machine automatically, silently, and outside the user's awareness .

Notably, the same symlink-vs.-security-check failure pattern had been fixed twice before in Claude Code's permission subsystem:

• CVE-2025-59829 (fixed September 2025): symlink bypass of deny rules in file permissions
• CVE-2026-25724 (fixed January 2026): same pattern again, deny-rule bypass via symlinks

Both prior fixes resolved the symlink before checking permissions — but that fix was never applied to the memory loader code path .

Broader Pattern: Claude Ecosystem and AI Coding Tool Security

Tego AI's disclosure is the second Claude ecosystem flaw in a week. On July 14, 2026, Tego disclosed that Claude Tag's Slack integration could be triggered by plain @Claude text in any message, potentially enabling unauthorized enterprise actions .

Beyond Tego's work, Claude Code has accumulated at least 28 CVEs in roughly one year of existence, including:

• Two CVSS 10.0 critical sandbox escapes: CVE-2026-39861 (symlink sandbox escape) and CVE-2026-25725 (settings.json sandbox bypass)
• CVE-2026-46406 (June 2026): the /copy command wrote responses to a hardcoded world-readable temp path /tmp/claude/response.md, letting any local user read secrets
• Check Point Research (February 2026): critical flaws (CVE-2025-59536, CVE-2026-21852) enabling RCE and API key theft via malicious repo-level configuration files

Cross-industry research shows this is not unique to Anthropic:

• GhostApproval (Wiz, July 2026): Symlink flaws in six AI coding assistants (Amazon Q Developer, Anthropic, Cursor, Google Gemini, GitHub Copilot, Vercel) let a booby-trapped repo make the tool write to a sensitive file while the user approves writing to a harmless one
• SymJack (Adversa AI, May 2026): A single symlink-hijack attack achieving RCE across six products (Claude Code, Gemini CLI, Cursor, Copilot, Grok Build, Codex CLI). The user approves a file copy; the kernel writes somewhere else
• TrustFall (Adversa AI, May 2026): Repo-defined MCP servers execute automatically once the user accepts the folder trust prompt

The underlying architectural tension is consistent across the industry: AI coding agents need broad filesystem, shell, and network access to be useful — but that elevated access is the same privilege an attacker needs. Every sandbox escape, path traversal, and trust-dialog bypass stems from this same challenge . The attack surface is not shrinking; new features add new vectors faster than existing ones are patched.