Is Claude Code safe for the enterprise? What the official settings cover, and what they don't

What it is

Adversa AI's October 2026 assessment of Claude Code in the enterprise. It argues that Anthropic's managed settings are a useful floor, but one that covers a narrow set of setups: managed devices, no local admin rights, Claude Code only, interactive sessions. The article quotes Anthropic's own managed settings and authentication documentation for the limits, then lists attacks that sit in the harness rather than the model. Adversa sells a coding agent security platform, and the final control is pitched at it.

How it works

Limits Anthropic's documentation states, per the article:

• A developer who is a local administrator "can edit the managed source itself". The suggested answer is for MDM to redeploy the file on a schedule, which narrows the window without closing it.
• Managed settings bind Claude Code only. Another tool, or a second Claude harness such as Claude Desktop with a personal API key, is not covered.
• Anthropic-hosted cloud sessions do not read a device's MDM profile. They need server managed settings.
• An API provider allowlist set only in server managed settings is "a convenience", "not enforcement".
• claude setup-token and the GitHub app installer enforce only the login method, so they can mint a token in a different organization.
• The setting that blocks an outdated binary does not end a session already running, so a long session keeps its old policy.
• Session transcripts sit in plaintext on disk for 30 days. Feedback submissions are kept for five years. Neither is covered by zero data retention.

Model layer figures:

• Auto mode has a 17% false negative rate on 52 curated overeager actions (Anthropic's figure).
• Users accept 93% of permission prompts.
• Auto mode became the default for Pro, Max and Team on 14 August 2026.
• On 26 August, Johann Rehberger published a chain that plants a struct.py file to shadow a standard Python module. It succeeded in 3 of 5 trials in one variant and 4 of 5 in another. Anthropic closed the report as informative.

Harness attacks:

• CVE-2025-59536 and CVE-2026-21852: project config was read before the trust dialog resolved, so opening a cloned repo could run shell commands and exfiltrate API keys. Fixed.
• TrustFall: accepting the folder trust prompt lets the project's MCP config spawn native processes outside the sandbox. Anthropic declined it as outside its threat model, and the behavior is still live.
• Deny rule bypass: deny rules stopped being evaluated on commands with more than about fifty subcommands, to save tokens. A fix appears in version 2.1.90 per the changelog only. No CVE was assigned.
• SymJack and GhostApproval: the approval prompt shows one target and the agent writes to another, through a symlink or a misdescribed path. Anthropic added sensitive-directory warnings after SymJack and rejected GhostApproval. AWS and Cursor issued CVEs for the same bug class.
• Miasma worm (June 2026): it planted hooks in the config directories of Claude Code, Cursor, Gemini CLI and VS Code, and disabled 73 Microsoft repositories. No CVE exists.
• LiteLLM (March 2026): Claude Code with permissions skipped upgraded to a trojaned LiteLLM release. In one account, endpoint behavior detection caught it, not the agent.

By Adversa's count, only two of the ten best documented attacks produced CVEs.

Preconditions / Affected

The gaps matter most where developers have local admin rights, several agents run side by side, or work runs in headless CI or Anthropic-hosted cloud sessions. On a managed fleet without admin rights and with MDM delivery, the locks hold for Claude Code only.

What to do

The article advises enabling the official settings everywhere, then adding five environment controls:

1. Keep long-lived credentials away from the agent. Use a credential proxy or short-lived, task-scoped tokens, and give the agent its own identity. Test whether any credential in reach can destroy both data and backups.
2. Deny egress by default, keep the allowlist short, and remember that an allowlisted domain that accepts arbitrary uploads is an exfiltration route.
3. Treat rules files, settings, hooks, skills, plugin manifests and MCP configs as code. Give them owners and review, and watch config directories for writes by anything other than a person.
4. Monitor actions across every agent, link them into chains, and block before the last step. Store the record off the machine.
5. Run auto mode, background runs and CI agents in a disposable container, VM or cloud runner with no production data and no open internet. NVIDIA's OpenShell (open source since 21 October) runs Claude Code in a kernel-isolated Linux sandbox with egress denied by default and credentials substituted outside the agent's reach.

Caveats

• The sandbox runtime is still labeled a research preview. Anthropic's 84% prompt reduction figure comes with no stated method.
• The sandbox-escape anecdote comes from a single informal vendor test.
• The deny-rule fix in 2.1.90 is inferred from the changelog, not confirmed by an advisory.
• OpenShell covers the CLI in a sandbox, not the laptop a developer uses all day.