STUPID-2026-0024

Claude Code MCP trust boundary failures allow workspace privilege escalation

6.0medium
March 22, 2026Source checkedRepro reported

Why 6/10

A researcher-demonstrated privilege escalation inside a workspace; it needs a malicious workspace and was closed as informative. No real-world victim is reported.

Scope
3/4
A whole machine or drive, an organisation's production system or data, or many credentials
Recoverability
2/3
Partly lost, or loss reported without saying whether it was recovered
Did it happen
1/2
Demonstrated (proof of concept, reproduction, controlled test or near-miss) with no real victim reported
Beyond the user
0/1
Only the user's own non-production work

The score is the sum of these four factors. How each factor is scored · scored 2026-10-29

  1. Instruction given

    Normal development tasks via Claude Code with MCP integrations

  2. Expected behavior

    MCP server interactions constrained by trust level; no privilege escalation possible

  3. Actual behavior

    Trust boundaries can be crossed through crafted MCP server configurations and tool descriptions; agent can be manipulated to perform out-of-scope privileged actions

  4. Damage

    Potential for workspace privilege escalation in Claude Code v2.1.63; Anthropic closed findings as Informative without CVE assignment

Full write-up

Security researcher Jashid Sany documented three systemic trust boundary failures in Claude Code v2.1.63 related to the Model Context Protocol (MCP): (1) weak MCP server configuration validation allowing untrusted servers to register with elevated trust, (2) insufficient tool confirmation prompts that can be bypassed by crafted tool descriptions, and (3) workspace trust escalation vulnerabilities where agents processing potentially malicious input can be manipulated to perform out-of-scope actions. All findings were submitted to Anthropic via HackerOne and closed as 'Informative'. The core failure: human-designed trust models break when autonomous agents process potentially adversarial input.

Classification

Agent
Claude Code
Failure mode
Security Vulnerability
Root cause
Other
Domain
Security
OWASP Agentic Top 10 (our mapping)
ASI03 Identity and Privilege Abuse · ASI04 Agentic Supply Chain Vulnerabilities list
MIT AI Risk Repository (our mapping)
2.2 AI system security vulnerabilities and attacks taxonomy
Source
Security Research

Related incidents

6.0
Claude Code loaded managed config from a world-writable Windows path, enabling local privilege escalation (CVE-2026-35603)
7.0
Claude Code leaked API keys via malicious repo settings before trust prompt
6.0
Cline's hub daemon silently reverted workspace files to stale state, repeatedly erasing a gitignored .env.local and collapsing a node_modules folder from 588 entries to 2 (GitHub #14819)
8.0
Symlink-hijack lets a booby-trapped repo overwrite config in Claude Code, Gemini CLI, Cursor, Copilot CLI, Grok Build and Codex (SymJack)
Discuss on Hacker News
Cite this record
StupidLLM. "STUPID-2026-0024: Claude Code MCP trust boundary failures allow workspace privilege escalation." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0024/ (accessed 2026-10-29). CC BY 4.0.

← STUPID-2026-0023By IDSTUPID-2026-0025 →

Get told when an agent breaks something

We document AI agent failures daily, severity-scored against a published scale. Each Monday, if any scored 7 or above that week — deleted data, leaked secrets, broken production — you get one email with the sources. When nothing did, you get nothing.

This database is callable over MCP — query it from inside your agent.