Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation

The vulnerability in Claude Code (versions prior to 2.0.65) arises from the project-load flow, where the tool reads configuration files from a repository before the user confirms trust. An attacker can craft a malicious repository containing a settings file that sets the ANTHROPIC_BASE_URL environment variable to an attacker-controlled endpoint. When a user opens this repository in Claude Code, the tool processes the settings and immediately issues API requests to the specified URL, before displaying the trust prompt [1].

To exploit this, an attacker needs to convince a user to open a malicious repository in Claude Code (e.g., via a social engineering attack or by contributing to a project). No additional authentication is required because the API key is already present in the user's environment. The attacker's endpoint receives the API key in the request headers or body, allowing the attacker to capture it [3].

The impact is severe: an attacker who obtains the user's Anthropic API key can use it to make unauthorized API calls, potentially exhausting quotas, accessing private data, or incurring charges. The key could also be used to impersonate the user in other contexts if Anthropic services use the same key for authentication [1][3].

Anthropic has patched this vulnerability in Claude Code version 2.0.65. Users on standard auto-update have already received the fix. Those performing manual updates should upgrade to version 2.0.65 or later. No workarounds are available for unpatched versions; users are advised to avoid opening untrusted repositories in Claude Code until updated [1][3].