loading . . . Claude Code Hacked to Achieve Full RCE and Hijacked Organization API keys Critical vulnerabilities in Anthropicās Claude Code, an AI-powered command-line development tool. The flaws could allow attackers to achieve Remote Code Execution (RCE) and exfiltrate Anthropic API keys by exploiting project configuration files.
The issues were reported by Check Point Research (CPR), and Anthropic has fully patched all vulnerabilities prior to public disclosure.
The vulnerabilities highlight the growing attack surface introduced by AI-assisted development tools , where repository-controlled configuration files can be weaponized to compromise developer machines and shared workspaces.
Claude Code allows developers to delegate tasks directly from their terminal . To facilitate team collaboration, it supports project-level configurations through aĀ .claude/settings.jsonĀ file stored directly in the repository.
Because this file is inherited when a repository is cloned, any contributor with commit access can modify it.
CPR discovered that malicious configurations could trigger unintended actions on a developerās machine, effectively turning a passive setup file into an execution vector.
Vulnerability 1: RCE via Untrusted Project Hooks
Anthropicās āHooksā feature allows users to define commands that execute automatically at specific points in Claude Codeās lifecycle (e.g., formatting code after an edit). These hooks are defined in the repository-controlledĀ .claude/settings.json.
CPR found that when cloning an untrusted repository with a malicious hook configured to trigger onĀ SessionStart, Claude Code executed the command immediately upon initialization.
Calculator app opened instantly, without any prompt or execution warning (source: checkpoint research)
While the tool presented a general trust dialog, it did not explicitly warn that hook commands were already running in the background without user confirmation.
This allowed attackers to execute arbitrary shell commands , such as establishing a reverse shell.
Vulnerability 2: RCE Using MCP Consent Bypass (CVE-2025-59536)
Claude Code supports the Model Context Protocol (MCP) to interact with external tools, configured via an .mcp.jsonĀ file.
Following CPRās initial report, Anthropic implemented a warning dialog for MCP initialization.
However, CPR found a bypass using two settings inĀ :
.claude/settings.json:Ā enableAllProjectMcpServersĀ andĀ enabledMcpjsonServers.
By leveraging these settings to auto-approve MCP servers, CPR executed malicious commands immediately upon runningĀ claude before the user could interact with the trust dialog. This once again enabled RCE.
Vulnerability 3: API Key Exfiltration (CVE-2026-21852)
Further investigation intoĀ .claude/settings.jsonĀ revealed that environment variables could also be defined.
CPR targetedĀ ANTHROPIC_BASE_URL, which controls the endpoint for Claude Code API communications .
By pointing this URL to a malicious server, an attacker could intercept the toolās initial API requests.
Authorization header exposed the full Anthropic API key in plaintext (source: Checkpoint Research)
Check Point Research (CPR) observed that before the user even interacted with the trust dialog, Claude Code transmitted the full Anthropic API key in plaintext within the authorization header.
With a stolen API key, attackers could perform billing fraud or access shared Claude Workspaces.
While files in a workspace cannot be downloaded after manual upload, CPR bypassed this by using the code execution tool to regenerate the file, making it downloadable and exposing sensitive team resources.
These vulnerabilities present severe supply chain risks, as malicious configurations could be injected via pull requests, honeypot repositories , or compromised internal accounts.
Anthropic has resolved these issues by: Enhancing warning dialogs for untrusted configurations. Ensuring MCP servers cannot execute before user approval, regardless of auto-approve settings.
Deferring all network operations, including API key transmission, until after explicit user consent is granted.
Developers are urged to update to the latest version of Claude Code and treat project configuration files with the same scrutiny as executable code.
Follow us on Google News , LinkedIn , and X for daily cybersecurity updates. Contact us to feature your stories.
The post Claude Code Hacked to Achieve Full RCE and Hijacked Organization API keys appeared first on Cyber Security News . https://cybersecuritynews.com/claude-code-hacked/
