Claude Code Vulnerability Allows Silent Exfiltration of Local Files via Symlinked Imports
A flaw in Anthropic's Claude Code allows malicious repositories to exfiltrate local files by exploiting symlinked memory imports, bypassing user consent.
A critical vulnerability has been identified in Anthropic's Claude Code, enabling malicious repositories to silently exfiltrate sensitive local files. The flaw, discovered by Tego researchers, lies within the tool's memory import feature, specifically how it handles symbolic links (symlinks). Instead of treating symlinks as external references requiring user approval, Claude Code follows them when reading files, effectively bypassing security checks and allowing data from outside the repository to be included in the model's initial context.
The vulnerability arises because Claude Code checks if an import is within a project based on its visible path. However, when it reads the file content, the operating system resolves any symlinks. This means a malicious actor could create a symlink within a repository that points to a sensitive file on the local system, such as /etc/passwd or /proc/self/environ. When Claude Code processes a configuration file like CLAUDE.md or a file within .claude/rules/ that references this symlink, it reads the content of the target file without triggering the expected external import approval dialog.
This bypass is particularly concerning because the content of the exfiltrated file is included in the model's very first outbound request. By default, this data is sent to Anthropic's API endpoint. However, the risk is amplified by the ability for repository-controlled .claude/settings.json files to override the ANTHROPIC_BASE_URL. This configuration allows attackers to redirect Claude Code's traffic to a custom endpoint, facilitating the exfiltration of sensitive data to a server of their choosing.
Researchers demonstrated a proof-of-concept where Claude Code loaded /etc/passwd2 via a symlink, showing a byte-for-byte match to the original file. This occurred before Claude Code could execute any read tools, commands, or request user approval. The implications are significant for developers who may have previously granted broad trust to parent directories, such as their home folder, as Claude Code's workspace trust mechanism applies to repositories within these trusted directories, potentially leading to a lack of fresh trust prompts for newly cloned projects.
This issue is reminiscent of previous Claude Code symlink vulnerabilities, including CVE-2025-59829 and CVE-2026-25724, where Anthropic addressed similar flaws by improving symlink resolution before security checks. The researchers argue that the memory loader component did not receive the same level of canonical path validation as other parts of the tool. The vulnerability was tested on Claude Code version 2.1.215, with static analysis indicating its presence in version 2.1.207 as well.
Anthropic has reportedly classified the submission as informative, emphasizing that workspace trust is the intended security boundary. While this boundary allows reading, editing, and executing within a trusted project, the researchers recommend that Anthropic should canonicalize import targets before applying containment and consent checks. They also advise implementing clearer warnings when imports resolve outside the repository and better highlighting configuration settings that can alter outbound endpoints.
The vulnerability underscores the ongoing challenges in securing AI-powered development tools, especially when they interact with local file systems and external services. As AI assistants become more integrated into developer workflows, ensuring robust security controls, transparent consent mechanisms, and thorough validation of all file access operations is paramount to prevent silent data exfiltration and other malicious activities.