.webp "Hidden Link Stealthily Transmits Files to Attackers")
Tego AI Exposes Security Flaws in Anthropic’s Claude Code Tool
Tel Aviv, Israel, July 24th, 2026, CyberNewswire — In a significant development, Tego AI has released a new investigation just a week after uncovering a vulnerability relating to Anthropic’s Claude Tag Slack integration. The latest report delves into the Claude Code, an advanced command-line coding tool developed by Anthropic, highlighting potential security risks that could compromise user data.
The recent findings indicate that when developers clone a typical repository and initialize Claude Code, the tool may inadvertently read and incorporate files from outside of the designated project. This can occur without any visible warning or approval prompt, raising serious concerns about the potential for unauthorized data access.
The core of the issue revolves around the common practice of including seemingly normal instruction files, like CLAUDE.md, within repositories. These files can utilize an @import directive linked to a symbolic link that points to a file located beyond the project boundaries. Upon cloning the repository and starting Claude Code, the tool inevitably follows this link, potentially fetching sensitive content from files that exist outside the immediate project environment.
What makes this vulnerability particularly alarming is its subtleness; no explicit commands are triggered, and users do not receive alerts about the external file being read. The security dialog that is supposed to detect out-of-project readings fails to activate, as it examines only the name of the link within the repository rather than the external file address that the link refers to.
The mechanism utilized for delivering this vulnerability is rooted in a repository file named link, which GitHub itself identifies as a symbolic link leading to /etc/passwd2—a path publicly accessible to anyone exploring the repository’s content.
Tomer Niv, the Head of Research at Tego AI, elaborated on the nature of this risk, stating, “Context is whatever gets sent to the model, and the model functions as a network endpoint like any other. So this is not a file that quietly sits in a prompt." He emphasized that once a repository is cloned and the “trust this folder?” query is answered—an affirmation many developers routinely give—a file outside the repository can be sent out during the initial network request without any additional code execution or knowledge from the model itself.
Once this happens, the out-of-project file’s contents are dispatched in the request body to Claude Code, leaving the local environment without any user knowledge, thus highlighting a critical gap in security.
Interestingly, this situation is not new to Anthropic. The company had previously addressed similar vulnerabilities, successfully mitigating them twice in the past. The current report stands out not because the flaw itself is unprecedented, but due to its location in an unguarded area—specifically, the startup memory loader. This component is crucial as it configures the session, sending data to the network before any model engagement occurs.
Tego AI’s research does not stop at identifying the security risk; it also reveals that a repository’s settings file can redirect Claude Code’s outbound endpoint to any host designated by the repository author. This behavior adds another layer of complexity, as it requires minimal access rights to execute, especially in continuous integration runners or standardized developer environments.
While Tego AI does not dispute Anthropic’s response regarding their “trust this folder” security boundary, they argue that this single prompt cannot bear the weight of its intended security role. Niv noted the gravity of having such a significant trust placed on a moment of limited information, especially since it cannot differentiate between harmful commands like “run my code” and those designed to extract sensitive credentials.
The company underscores that as enterprises increasingly deploy AI coding agents, understanding and systematizing these authorization parameters becomes vital. The research also revisits previous security themes Tego AI has explored, such as the authorizations surrounding AI agents and the sensitive nature of trusting seemingly basic commands.
In summary, the report from Tego AI raises essential questions about the security frameworks surrounding AI tools and the level of authorization control they afford. It emphasizes the need for improved vigilance against the potential for unauthorized data access—even from well-meaning tools like Claude Code. As the field of artificial intelligence in coding continues to evolve, so too must the security measures accompanying it.
For those interested in a more detailed examination of these findings, Tego AI has made their complete technical report available online at: Tego AI Report.
About Tego AI
Tego AI operates in stealth mode as a cybersecurity firm specializing in runtime security and control technologies tailored for enterprise AI agents. The company’s platform facilitates monitoring agent activity and preventing unauthorized actions that may threaten sensitive data integrity. Following its latest disclosure, Tego AI has signaled there are more disclosures on the horizon, reaffirming its commitment to advancing security standards in the rapidly evolving field of artificial intelligence.