Poco Agent
Monthly
Incomplete session cleanup in poco-ai/poco-agent up to version 0.5.4 can permanently destroy the host user's ~/.claude directory - including all Claude Code chat history stored under ~/.claude/projects - when the agent runs outside a container environment. The WorkspaceManager._setup_session_persistence method performs an unconditional rmtree followed by a symlink swap on ~/.claude without verifying a container context, and the corresponding cleanup phase can additionally unlink pre-existing ~/.claude symlinks unrelated to poco-agent. A publicly available exploit exists via GitHub issue #131 and PR #132, though the CVSS 4.0 base score of 2.9 reflects high attack complexity and impact limited to low integrity and availability loss with no confidentiality breach.
Incomplete session cleanup in poco-ai/poco-agent up to version 0.5.4 can permanently destroy the host user's ~/.claude directory - including all Claude Code chat history stored under ~/.claude/projects - when the agent runs outside a container environment. The WorkspaceManager._setup_session_persistence method performs an unconditional rmtree followed by a symlink swap on ~/.claude without verifying a container context, and the corresponding cleanup phase can additionally unlink pre-existing ~/.claude symlinks unrelated to poco-agent. A publicly available exploit exists via GitHub issue #131 and PR #132, though the CVSS 4.0 base score of 2.9 reflects high attack complexity and impact limited to low integrity and availability loss with no confidentiality breach.