Top 10 attacks on Claude Code and what each one actually broke

What it is

Ten distinct Claude Code attacks with per-item mechanics, patch versions, and CVE status that the existing summary names but doesn't detail. The page's core value is the per-attack specifics and a vendor-response breakdown, not the catalog list itself.

How it works — the two attacks with confirmed fixes

CVE-2025-59536 / CVE-2026-21852 (Check Point): Claude Code read .claude/settings.json before the startup trust dialog resolved. CVE-2025-59536 (CVSS 8.7, CWE-94) is arbitrary shell execution via hooks/MCP/env vars at that pre-trust read; fixed in 1.0.111. CVE-2026-21852 is Anthropic API key theft via a settings file pointing ANTHROPIC_BASE_URL at an attacker endpoint; fixed in 2.0.65. Both patched pre-disclosure — this is the only entry with an Anthropic-acknowledged CVE pair.

Plugin4Shell (AIR Security): git resolves a 40-hex-char ref as a branch before a commit SHA when both exist. An attacker makes their plugin repo's default branch named identically to the pinned SHA, so Claude Code's auto-update (on by default) silently swaps in attacker content while reporting a clean pinned install. Patched in 2.1.179, no CVE, no in-the-wild exploitation reported. Caveat stated in the page: only exploitable on hosts allowing 40-hex branch names — GitHub rejects these outright, so real exposure is Bitbucket/self-hosted marketplaces.

Preconditions / Affected

• The 50-subcommand deny-rule bypass (CLAUDE.md with payload at step 51) has a fix noted in v2.1.90, though the page flags the changelog mapping as inferred, not confirmed by Anthropic.
• TrustFall and GhostApproval remain unpatched: Anthropic declined both as outside its threat model (folder-trust / directory-approval constitutes consent in their view).
• Agentjacking has no structural fix from Sentry; Tenet Security measured an 85% success rate across Claude Code, Cursor, and Codex, and identified 2,388 organizations with DSN-exposed projects.

What to do

The page's concrete recommendations:

• Review .claude/settings.json, .mcp.json, hooks, and plugin pins in code review/pre-commit, same as a Dockerfile.
• Open unfamiliar repos in a disposable container/VM — Miasma and CVE-2025-59536 both detonate at project open, pre-trust-dialog.
• Don't rely on approval prompt text as an integrity control (SymJack, GhostApproval both show displayed text diverging from actual operation).
• Disable or scrutinize plugin auto-update; pin to a marketplace you control.
• Use short-lived, separate-identity credentials for the agent rather than ambient developer permissions (mitigates the API-key exfiltration pattern in CVE-2026-21852).
• Apply the three patched versions: 1.0.111, 2.0.65, 2.1.179 (and reportedly 2.1.90 for the deny-rule cap).

Caveats

Of the ten attacks, only Check Point's pair carries an Anthropic-acknowledged CVE; GhostApproval produced CVEs at AWS (CVE-2026-12958) and Cursor (CVE-2026-50549) but none at Anthropic. The deny-rule-cap patch mapping to v2.1.90 is the page's own inference, not a confirmed changelog match.