Caught in the Hook: RCE and API Token Exfiltration Through Claude Code Project Files (CVE-2025-59536, CVE-2026-21852)
Three attacks carried in a repo's own Claude Code config: project hooks run after one trust click (GHSA-ph6w-f82w-28w6, fixed 1.0.87); repo settings auto-approve MCP servers so their commands run before the trust dialog (CVE-2025-59536, fixed 1.0.111); a repo-set ANTHROPIC_BASE_URL sends the user's API key to the attacker before trust is given (CVE-2026-21852, fixed 2.0.65). A stolen key reached the whole Workspace's files. All fixed before public disclosure 2026-02-25.
How deeply this was read: the full write-up, fetched 2026-09-24 from Check Point Research (published 2026-02-25), including its disclosure timeline. The patched version numbers are not in the Check Point write-up; they were read the same day from the vulnerability records the write-up points to: NVD for the two CVEs, and the OSV/GitHub advisory database for all three advisories. Each version below says where it came from.
Vendor bias, stated up front. Check Point sells security products, and this is its own research team describing its own finds. The affected product is Claude Code, made by Anthropic. Nothing here is independently reproduced — but every flaw was confirmed by Anthropic publishing an advisory, which is as close to independent confirmation as a disclosed bug gets. All three were fixed before the write-up was published. Read it as a closed case study, not a live threat. As of 2026-09-24.
Abstract
From the write-up's executive summary:
Check Point Research has discovered critical vulnerabilities in Anthropic's Claude Code that allow attackers to achieve remote code execution and steal API credentials through malicious project configurations. The vulnerabilities exploit various configuration mechanisms including Hooks, Model Context Protocol (MCP) servers, and environment variables - executing arbitrary shell commands and exfiltrating Anthropic API keys when users clone and open untrusted repositories. [...] All reported issues have been successfully patched prior to this publication.
The three attacks, in plain words
A project can carry its own Claude Code settings in .claude/settings.json and its own MCP server
list in .mcp.json. Both are ordinary files in the repository, so anyone who can commit to the
repo can change them. Each attack below is "put something in those files and wait for someone to
open the project".
| # | What the attacker puts in the repo | What happened on the victim's machine | Record | Fixed in |
|---|---|---|---|---|
| 1 | A hook — a shell command set to run when a session starts | After one click on the "trust this folder" prompt, the command ran with no further prompt. The prompt said files might be executed "with your permission"; it did not say hooks would run automatically. | GitHub advisory GHSA-ph6w-f82w-28w6 (no CVE listed in the write-up) | 1.0.87 (OSV/GitHub advisory database: affected from 0, fixed 1.0.87) |
| 2 | An MCP server in .mcp.json, plus the settings enableAllProjectMcpServers or enabledMcpjsonServers in the repo's .claude/settings.json | The MCP server's start-up command ran before the trust dialog could be read — the demo calculator opened on top of the pending prompt. This got round the better warning Anthropic added after attack 1. | CVE-2025-59536 (advisory GHSA-4fgq-fpq9-mr3g) | 1.0.111 (NVD: "This issue is fixed in version 1.0.111") |
| 3 | An ANTHROPIC_BASE_URL environment setting pointing at the attacker's server | Claude Code sent API requests — carrying the user's full API key in the authorisation header — before the trust dialog was answered. No interaction needed. | CVE-2026-21852 (advisory GHSA-jh7p-qr78-84p7) | 2.0.65 (NVD: "Prior to version 2.0.65 [...] update to version 2.0.65, which contains a patch") |
Severity as published: GHSA-ph6w-f82w-28w6 HIGH; CVE-2025-59536 HIGH, CVSS 4.0 base score 8.7; CVE-2026-21852 MEDIUM on NVD (CVSS 4.0 base 5.3), MODERATE in the GitHub advisory database.
What a stolen key reached
The write-up follows attack 3 further. An Anthropic API key belongs to a Workspace, and files stored in a Workspace belong to the Workspace, not the key. Uploaded files are marked non-downloadable, but the researchers asked Claude's code-execution tool to make a copy of one file; the copy counted as a generated file and could be downloaded. So a single stolen key gave read and write access to every file the team had stored there, plus the ability to delete files, fill the 100 GB storage quota, and run up the account's bill. One developer's mistake became the team's exposure.
Disclosure timeline (from the write-up)
| Date | Event |
|---|---|
| 2025-07-21 | Hooks flaw reported to Anthropic |
| 2025-08-26 | Anthropic's final fix for the hooks flaw |
| 2025-08-29 | Anthropic publishes GHSA-ph6w-f82w-28w6 |
| 2025-09-03 | MCP consent-bypass flaw reported |
| 2025-09-22 | Fix for the bypass |
| 2025-10-03 | Anthropic publishes CVE-2025-59536 |
| 2025-10-28 | API-key exfiltration flaw reported |
| 2025-12-28 | Fix for the exfiltration |
| 2026-01-21 | Anthropic publishes CVE-2026-21852 |
| 2026-02-25 | Public disclosure |
Report-to-fix time: 36 days, 19 days and 61 days respectively (arithmetic on the dates above).
How Anthropic fixed them (as described in the write-up)
- A clearer warning when a project contains untrusted Claude Code configuration.
- MCP servers cannot start before the user approves, whatever the repo's settings say.
- No API request is sent until the user has confirmed the trust dialog.
The common thread: nothing the repository controls may act before the user says yes.
Limitations
- A vendor's write-up of its own research; no independent reproduction beyond Anthropic's advisories.
- The write-up gives no version numbers. The "fixed in" column comes from NVD and the OSV/GitHub advisory records, read 2026-09-24; the write-up's own advice is simply to run the latest version.
- One tool. Whether other coding agents that read repo-level config have the same flaw is argued but not tested here.
- The dates of GHSA-ph6w-f82w-28w6 differ by record: the write-up says Anthropic published it on 2025-08-29; the OSV record shows 2025-09-03. Both are recorded here as published.
How it bears on the through-line
The KB tracks the path from a token price to a task price. This source puts a price on a cost no
token price shows: a finished task can hand an attacker a shell or the team's API key, and the
fix is a human confirmation step before anything the repo controls may run. It is also the
cleanest real case on this rung of the pattern the protocol papers describe in theory — config
files treated as harmless data are in fact instructions. And it is the one incident on the rung in
a tool this project runs every day: this repository commits a .claude/settings.json that defines
hooks, and its working copies carry an .mcp.json. Standing on the posture is did it; the attacks themselves were not re-run here.
Source: Caught in the Hook: RCE and API Token Exfiltration Through Claude Code Project Files by Aviv Donenfeld and Oded Vanunu, Check Point Research, 2026-02-25. Version data: NVD CVE-2025-59536, NVD CVE-2026-21852, OSV GHSA-ph6w-f82w-28w6.