Anthropic Ai Claude Code
Monthly
A time-of-check to time-of-use (TOCTOU) race condition in Anthropic's Claude Code CLI allows an attacker who already has write access to a shared project workspace to atomically replace a project file with a symlink after the agent has validated the path but before it writes, causing Claude Code to follow the link and write to an arbitrary file outside the sandbox - for example a shell configuration file that will later be sourced by a higher-privileged session. Exploitation is bounded: it requires local write access to a workspace shared with a more privileged Claude Code session, requires winning a narrow timing race rather than triggering deterministically, and requires the privileged session to actually perform a write to the targeted path; single-user installations with no shared workspace are not exposed. There is no indication of active exploitation (no CISA KEV listing) and no public exploit identified at time of analysis, though Anthropic has already shipped the fix through the standard auto-update channel, leaving only manual-update holdouts at risk.
Credential-precedence handling in Claude Code causes the CLI to request an organization's server-managed settings with a locally stored API key instead of the user's authenticated Claude Enterprise or Team session, so when that key is rejected the session starts without the organization's policy - permission deny rules, model restrictions and managed-only locks go unenforced - or keeps applying a stale cached policy while still operating as the organization account. Only organizations that use server-managed (cloud policy) settings are affected: Claude for Enterprise from version 2.0.68 and Claude for Work (Team) from version 2.1.38, and the issue requires local access to a device where an API key was previously persisted via /login or written directly into the configuration (PR:L), with the complete policy-loss case additionally requiring that no managed settings were ever cached on that machine. Severity is low (CVSS 4.0 base 2.0; local, integrity-only, no confidentiality or availability impact), endpoint-managed MDM or file-based settings are not affected, and no public exploit identified at time of analysis.
A time-of-check to time-of-use (TOCTOU) race condition in Anthropic's Claude Code CLI allows an attacker who already has write access to a shared project workspace to atomically replace a project file with a symlink after the agent has validated the path but before it writes, causing Claude Code to follow the link and write to an arbitrary file outside the sandbox - for example a shell configuration file that will later be sourced by a higher-privileged session. Exploitation is bounded: it requires local write access to a workspace shared with a more privileged Claude Code session, requires winning a narrow timing race rather than triggering deterministically, and requires the privileged session to actually perform a write to the targeted path; single-user installations with no shared workspace are not exposed. There is no indication of active exploitation (no CISA KEV listing) and no public exploit identified at time of analysis, though Anthropic has already shipped the fix through the standard auto-update channel, leaving only manual-update holdouts at risk.
Credential-precedence handling in Claude Code causes the CLI to request an organization's server-managed settings with a locally stored API key instead of the user's authenticated Claude Enterprise or Team session, so when that key is rejected the session starts without the organization's policy - permission deny rules, model restrictions and managed-only locks go unenforced - or keeps applying a stale cached policy while still operating as the organization account. Only organizations that use server-managed (cloud policy) settings are affected: Claude for Enterprise from version 2.0.68 and Claude for Work (Team) from version 2.1.38, and the issue requires local access to a device where an API key was previously persisted via /login or written directly into the configuration (PR:L), with the complete policy-loss case additionally requiring that no managed settings were ever cached on that machine. Severity is low (CVSS 4.0 base 2.0; local, integrity-only, no confidentiality or availability impact), endpoint-managed MDM or file-based settings are not affected, and no public exploit identified at time of analysis.