A newly disclosed flaw in Claude Code, Anthropic’s AI coding assistant, allows an attacker-controlled repository to silently read files from outside the project directory and transmit their contents to a remote server before the AI model performs any action without triggering any approval dialog. These files support an @import directive that pulls external content into the model’s context at session startup, a pattern Anthropic’s own documentation recommends for syncing shared instruction files. Claude Code Symlink Flaw If a repository includes an in-tree symlink like @./link pointing to a file outside the project, such as /etc/passwd or ~/.aws/credentials, the classifier only sees the internal-looking path ./link and treats it as safe.
Without a natural checkpoint for security prompts, no tool_use or file-read action occurs, leaving Claude Code without an appropriate control mechanism: an external-import approval dialog that should appear the first time a memory file references content outside the project. Anthropic asserts that workspace-trust acceptance already authorizes this behavior within its threat model, viewing the external-import dialog as a usability enhancement rather than an enforced security boundary. Users can audit trusted directories by running `jq -r '.projects|to_entries[]|select(.value.hasTrustDialogAccepted==true)|.key' ~/.claude.json` on macOS/Linux, and should avoid cloning untrusted repositories into previously trusted parent directories to cut through SOC investigation blind spots and contain threats earlier, reducing response costs and minimizing business disruption with ANY.RUN.
