aiqbench analysis
This research reveals a critical security vulnerability in Anthropic's Claude Code where symbolic links allow unauthorized files to be silently exfiltrated during initial model requests without user approval or code execution. The flaw exploits standard repository structures, meaning attackers can distribute malicious repositories that compromise data privacy simply by cloning them and initiating the tool. This incident underscores significant risks surrounding context injection and file system access controls in agentic AI workflows.
Tego AI Discloses Second Claude Flaw in a Week: Hidden Link Silently Sends Files to Attackers
.webp%3Fssl%3D1&w=640)
Tel Aviv, Israel, July 24th, 2026, CyberNewswire One week after disclosing that Anthropic’s Claude Tag Slack integration could be driven by plain “@Claude” text, Tego AI today published a second piece of research on the Claude ecosystem. This one focuses on Claude Code, Anthropic’s agentic command-line coding tool. Cloning an ordinary repository and starting Claude […] The post Tego AI Discloses Second Claude Flaw in a Week: Hidden Link Silently Sends Files to Attackers appeared first on Cyber Security News.
One week after disclosing that Anthropic’s Claude Tag Slack integration could be driven by plain “@Claude” text, Tego AI today published a second piece of research on the Claude ecosystem. This one focuses on Claude Code, Anthropic’s agentic command-line coding tool. Cloning an ordinary repository and starting Claude Code can cause the tool to read a file from outside the project and include it in the model’s first request, without a warning or approval prompt the user would recognize. The technique is ordinary, and that is part…
Excerpt shown under the publisher's RSS terms · 87 words · full text and figures are on the publisher's site
Related coverage
[AINews] Reality Checks on AI News (Yegge shuts down Gas Town, Databricks’ +60% Astra cost)
Latent Space · Sep 17, 2026
Weekly Cyber Security Newsletter– Claude Hacked 3 Companies, Cisco 0-Day, Word Copilot and VMware Flaw +20 Stories
Cybersecurity News · Aug 2, 2026
Weekly Cyber Security Newsletter Bulletin – Entra ID RCE, Claude Code Ransomware, T-Mobile Cable, Azure Credential Theft +20 Stories
Cybersecurity News · Aug 23, 2026
Weekly Cybersecurity Newsletter Bulletin – CrowdStrike Falcon, Chrome 0-Day, GPT-6 Astra, Dropbox Breach and 20+ Stories
Cybersecurity News · Sep 7, 2026