Tego AI, a cybersecurity company, disclosed a security vulnerability in Anthropic's Claude Code—an agentic command-line coding tool—that allows the unauthorized exfiltration of local files. By including a symbolic link (a file acting as a pointer to another location) within a repository, an attacker can trick the tool into reading sensitive files outside the project directory. When a developer clones the repository and initializes Claude Code, the tool automatically follows this link and incorporates the target file's content into the model's initial request. This process occurs without triggering security alerts, file-edit approval prompts, or tool-call notifications.

Tego AI’s research identified that this flaw exists within the tool's startup memory loader. While Anthropic previously addressed similar symbolic-link vulnerabilities in other code paths, specifically documented in CVE-2025-59829 and CVE-2026-25724, this particular entry point remained unprotected. The data is sent to the network before the user interacts with the model or the model performs any action, posing a risk in environments where file paths are predictable, such as CI runners or standardized developer images.

Tomer Niv, Head of Research at Tego AI, stated that the company confirmed this behavior against Claude Code v2.1.x. Tego AI reported the issue to Anthropic via HackerOne in July 2026. Anthropic closed the report as Informative, maintaining that the "trust this folder" dialog serves as the established security boundary for Claude Code; once a user accepts this prompt, the tool is authorized to perform read, edit, and execute operations within the repository. Tego AI emphasizes that its disclosure aims to highlight limitations in this authorization model, arguing that the current "trust" mechanism lacks the granularity required for enterprise-grade security.

This disclosure marks Tego AI's second security finding regarding the Claude ecosystem within a single week. The company, which develops runtime security for AI agents, intends to continue releasing research regarding authorization challenges in enterprise agentic systems. Tego AI suggests that security teams should account for the broad scope of permissions granted during repository initialization when deploying AI coding assistants in sensitive environments.

Tego AI, a cybersecurity company, disclosed a security vulnerability in Anthropic's Claude Code—an agentic command-line coding tool—that allows the unauthorized exfiltration of local files. By including a symbolic link (a file acting as a pointer to another location) within a repository, an attacker can trick the tool into reading sensitive files outside the project directory. When a developer clones the repository and initializes Claude Code, the tool automatically follows this link and incorporates the target file's content into the model's initial request. This process occurs without triggering security alerts, file-edit approval prompts, or tool-call notifications.

Tego AI’s research identified that this flaw exists within the tool's startup memory loader. While Anthropic previously addressed similar symbolic-link vulnerabilities in other code paths, specifically documented in CVE-2025-59829 and CVE-2026-25724, this particular entry point remained unprotected. The data is sent to the network before the user interacts with the model or the model performs any action, posing a risk in environments where file paths are predictable, such as CI runners or standardized developer images.

Tomer Niv, Head of Research at Tego AI, stated that the company confirmed this behavior against Claude Code v2.1.x. Tego AI reported the issue to Anthropic via HackerOne in July 2026. Anthropic closed the report as Informative, maintaining that the "trust this folder" dialog serves as the established security boundary for Claude Code; once a user accepts this prompt, the tool is authorized to perform read, edit, and execute operations within the repository. Tego AI emphasizes that its disclosure aims to highlight limitations in this authorization model, arguing that the current "trust" mechanism lacks the granularity required for enterprise-grade security.

This disclosure marks Tego AI's second security finding regarding the Claude ecosystem within a single week. The company, which develops runtime security for AI agents, intends to continue releasing research regarding authorization challenges in enterprise agentic systems. Tego AI suggests that security teams should account for the broad scope of permissions granted during repository initialization when deploying AI coding assistants in sensitive environments.