Kiran 
A newly disclosed flaw in Claude Code, Anthropic’s AI coding assistant, shows how a single, ordinary-looking symlink committed to a Git repository can trick the tool into reading files from outside the project and shipping their contents to a remote server before the AI model ever takes an action. No malicious prompt, no tool call, and in many cases, no security warning at all.
The research comes from Tomer Niv, who found that Claude Code’s memory-loading feature, the mechanism that reads project instructions from CLAUDE.md and .claude/rules/** files, contains a mismatch between how it checks permissions and how it actually reads files. That gap is enough to turn a routine git clone into a silent data exfiltration event.
Claude Code supports an @import directive that pulls external files into the model’s context at startup. It’s a documented, widely used feature for keeping instructions synced across tools.
Claude Code Symlink Flaw
The catch is that Claude Code checks whether an import is “external” by examining the literal, pre-resolution path, but it reads the file after the operating system resolves any symlinks.
That inconsistency is the entire vulnerability. An attacker commits a symlink inside a repository, something like link, pointing to a file outside the project entirely, such as /etc/passwd or a predictable credentials path.
Because Git stores symlinks as lightweight pointers, they survive cloning intact. When Claude Code loads CLAUDE.md and encounters @./link, the path looks internal, so no external-import warning fires.
But the actual file read follows the symlink to wherever it points, and that content gets labeled in the model’s context as legitimate, “checked into the codebase” project instructions.
The tego confirmed this on Claude Code v2.1.215: the targeted file’s contents appeared verbatim in the very first request sent to the model, before any tool call or model decision occurred.
Claude Code does have a safeguard for exactly this scenario: an approval dialog meant to trigger the first time a memory file imports something from outside the project.
But because the classifier evaluates the unresolved path, a symlink dressed up as an in-repo file skips the check entirely. Testing showed that when a CLAUDE.md file contained both a direct external import and a symlinked one pointing to the same location, the dialog flagged the direct import and said nothing about the symlink.
In non-interactive use, cases like CI pipelines or scripted runs, there’s no prompt whatsoever, since Claude Code intentionally defers trust decisions to the calling process.
This isn’t a theoretical context-window issue. The researcher captured outbound network traffic showing the file’s contents embedded in the JSON body of Claude Code’s first HTTPS request to api.anthropic.com.
On top of that, repositories can commit a .claude/settings.json file that sets ANTHROPIC_BASE_URL, redirecting that same request, imported file and all, to an attacker-controlled endpoint, with no separate prompt naming the new destination.
This is the third time this exact symlink-resolution mismatch has surfaced in Claude Code. Two earlier instances, tracked as CVE-2025-59829 and CVE-2026-25724, were reported through HackerOne and patched correctly by resolving symlinks before enforcing permission checks.
Both fixes lived in the permission subsystem governing file access. The memory loader, however, sits on a separate code path that never received the same hardening, meaning the same root cause survived two rounds of patching.
Anthropic was notified via HackerOne on July 18, 2026, and closed the report as “Informative” two days later. Anthropic’s position is that the workspace-trust dialog, the single “trust this folder?” prompt users see, already constitutes the security boundary, and that reading a file through a committed symlink falls within what that trust grants.
The researcher disputes not the triage itself, but the underlying assumption: that a single, often long-forgotten trust decision should carry enough weight to justify reading and transmitting arbitrary files a user never explicitly approved.
About the Author
Potheeswaran 
