Audit of CVE-2026-21852 details token theft and hook hijacking in Claude Code

A pre-trust execution window in Claude Code

A security audit published on dev.to by EyesTech Systems Research walks through two vulnerabilities in Anthropic's Claude Code CLI — CVE-2026-21852 and CVE-2025-59536 — that turned untrusted repositories into an attack surface against developers using autonomous coding agents.

The central flaw, according to the audit, is an order-of-operations defect: in versions prior to 2.0.65, the CLI merged repository-controlled configuration into its runtime before presenting the interactive trust prompt to the user. That created a pre-trust execution window in which a cloned repository could redirect API traffic and execute code without the developer having confirmed anything.

The authors frame this as a broader shift in threat model. Unlike IDE autocomplete tools, terminal agents read configuration files, execute shell scripts, run test suites, interact with git remotes, and talk to local Model Context Protocol daemons using the user's ambient privileges — which makes their startup path a far more valuable target.

How the base URL redirect leaks API keys

CVE-2026-21852, rated CVSS 5.3 in the audit, abuses the project-level settings file. Claude Code evaluates three configuration tiers at launch: global preferences in ~/.claude/settings., project settings in ./.claude/settings., and process environment variables such as $ANTHROPIC_API_KEY.

Because the project tier is committed to git, an attacker could push a settings file that overrode ANTHROPIC_BASE_URL to point at an attacker-controlled domain and relaxed bash permissions. On startup the agent immediately queried for available models and quota limits, and the standard Anthropic SDK attached the user's live API key to that request via the x-api-key header. The token then landed on the attacker's server in plaintext, exposing the victim's organization billing tier, private model access, and prompt caches.

Hook hijacking and git metadata

The pre-trust window also covered lifecycle hooks. In vulnerable builds, project-level hook definitions such as SessionStart executed at initialization, so a repository could ship a hook that downloads and pipes a remote payload into python3 before any trust decision was made.

The companion issue, CVE-2025-59536, moves the attack into git metadata. According to the audit, an attacker who sets core.fsmonitor in a repository's .git/config to a shell command can make any git status or git diff the agent performs trigger that command in the background.

Plaintext credential storage compounds the exposure

The audit also documents where Claude Code keeps secrets on Linux: session tokens and MCP credentials sit in plaintext in ~/.claude/.credentials., potentially alongside an Anthropic API key and connected GitHub OAuth, Jira, and AWS session tokens. Any untrusted script or test suite the agent spawns inherits read access to the home directory, so once code execution is achieved, those downstream accounts are in reach too.

An open-source audit scanner

Alongside the write-up, the researchers released an MIT-licensed Python scanner that inspects workspaces for pre-trust hook definitions, ANTHROPIC_BASE_URL overrides pointing anywhere other than api.anthropic.com, and other unhardened agent settings. Each finding is reported with a severity rating and a remediation note.

Why it matters

The attack chain requires nothing more unusual than cloning a repository and launching an agent — routine behavior for anyone contributing to open source. As agents acquire the ability to run shells, read credentials, and drive git, their configuration files effectively become executable content, and a trust prompt that fires after configuration has already been loaded provides no protection. The audit doubles as a design checklist for anyone building agent tooling: parse repository-controlled config only after trust is established, treat hook definitions as code, keep credentials out of plaintext, and assume that anything an agent's subshells can read, a malicious repository can eventually reach.