STUPID-2026-0083

Claude Code leaked API keys via malicious repo settings before trust prompt

7.2high
January 20, 2026VerifiedReproducible

  1. Instruction given

    Open and start working in a repository containing a project-level Claude Code settings file.

  2. Expected behavior

    Claude Code should display the workspace trust prompt and wait for user confirmation before making any network requests driven by that repository's configuration.

  3. Actual behavior

    If the untrusted repository's settings file set ANTHROPIC_BASE_URL to an attacker-controlled endpoint, Claude Code issued API requests to that endpoint before the trust prompt was ever shown, sending the user's Anthropic API key along with them.

  4. Damage

    Simply opening a crafted, untrusted repository in Claude Code could exfiltrate the developer's active API key to attacker infrastructure. Fixed in Claude Code 2.0.65; users on auto-update received the patch automatically.

Claude Code's project-load flow processed a repository's settings file — including an `ANTHROPIC_BASE_URL` override pointing at an attacker-controlled endpoint — before displaying the workspace trust prompt that is supposed to gate exactly this kind of untrusted configuration. As a result, opening a malicious repository could cause Claude Code to issue live API requests to the attacker's server carrying the user's API key, with no opportunity to review or reject the redirect first. Tracked as CVE-2026-21852 (GHSA-jh7p-qr78-84p7, CWE-522, CVSS 5.3), the flaw affected versions of `@anthropic-ai/claude-code` below 2.0.65 and was fixed in that release.

Classification

Agent
Claude Code
Failure mode
Security Vulnerability
Root cause
Logic Error
Domain
Security
Source
Security Research

Related incidents

10.0
Gemini CLI silently executed arbitrary code from an untrusted repo (CVE-2026-12537, CVSS 10.0)
10.0
Malicious cloned repository triggered code execution in Cursor on Windows
10.0
AI vibe-coded Next.js app pinned vulnerable dependency — cryptominer compromised production server
10.0
Claude Code wiped DataTalks.Club's production infrastructure — 2.5 years of course data — during an AWS migration
Discuss on Hacker News

Get told when an agent breaks something

We document AI agent failures daily, severity-scored against a published scale. When one lands at 7.0 or above — deleted data, leaked secrets, broken production — you get an email with the source. When nothing does, you get nothing.

This database is callable over MCP — query it from inside your agent.