A week after publishing research on Anthropic’s Claude Tag Slack integration, security firm Tego AI has released a second disclosure concerning the Claude ecosystem — this time targeting Claude Code, Anthropic’s command-line coding agent. The finding: simply cloning a repository and starting Claude Code can cause the tool to quietly read a file from outside the project and fold its contents into the very first request sent to the model, with no approval prompt the user would recognize as unusual.

An Old Trick in a New Context

The technique itself is not novel, which is part of what makes it notable. A repository can include an ordinary-looking instructions file, CLAUDE.md, containing an @import directive that points to a symbolic link committed elsewhere in the repository. When a developer clones that repository and launches Claude Code, the tool follows the link wherever it resolves — potentially to a file far outside the project directory — and includes that file’s contents in its startup request to the model.

No tool call fires during this process, and no file-edit approval dialog appears. The safeguard Claude Code normally uses to flag out-of-project file reads checks the name of the link as it appears inside the repository, such as ./link, rather than the external location the link actually resolves to. In the proof of concept Tego AI published, the repository contained a file literally named “link,” which GitHub itself displays as pointing to /etc/passwd2, visible to anyone browsing the repository in a browser.

Why It Matters More Than a Typical Symlink Bug

“Context is whatever gets sent to the model, and the model is a network endpoint like any other,” said Tomer Niv, Head of Research at Tego AI, in comments provided to Cybersecurity News. The point he’s making is subtle but important: unlike a symlink bug that just exposes a file to a local process, this one places the file’s contents directly into an outbound network request the moment a session starts — before the model has taken any action and without any code execution on the victim’s part.

Tego AI notes that Anthropic has fixed this general class of flaw twice before, through CVE-2025-59829 and CVE-2026-25724, both reported via HackerOne and resolved in Claude Code’s permission subsystem. What the new research shows is that the same underlying defect — a security check inspecting one path while the filesystem actually follows a symlink to another — persisted on a third code path: the startup memory loader, which those earlier fixes never touched.

The write-up also revisits a separately known behavior: a repository-committed settings file can redirect Claude Code’s outbound network endpoint to a host of the repository author’s choosing, meaning the exfiltrated content doesn’t necessarily have to travel to Anthropic’s own servers at all.

How Anthropic Responded

Tego AI reported the issue to Anthropic through HackerOne in July 2026. Anthropic closed the report as “Informative” rather than treating it as a standalone vulnerability, on the grounds that under Claude Code’s threat model, the “trust this folder” prompt a user sees before running the tool is itself the security boundary — and accepting it already grants a project broad read, edit, and execute access over the local environment.

Tego AI does not dispute that Anthropic is applying its own stated model consistently. Its argument is about how much that single click is being asked to carry. “A single ‘trust this folder’ click is being asked to carry an enormous amount of weight, at the least informed moment possible, before you have seen anything the repository does,” Niv said, adding that in many real deployments the trust decision is inherited from a parent directory and never explicitly shown for the specific repository in question.

The Bigger Authorization Question

Tego AI frames both of its recent disclosures — the earlier Claude Tag Slack finding and this one — as pointing at the same unresolved issue for enterprise AI agents: who, or what, is actually authorized to instruct the agent and reach the data and systems it can touch. The Slack research raised that question about an inbound chat message; this one raises it about an ordinary git clone.

Tego AI confirmed the behavior against Claude Code version 2.1.x and has published a full technical write-up on its own blog. The company, which builds runtime security and monitoring tooling for enterprise AI agents, says this is its second public disclosure in a week and has signaled that more research on agentic AI tooling is on the way.

For security teams evaluating AI coding assistants, the practical takeaway is to treat repository trust decisions with the same scrutiny given to executing unknown code, since — at least under Claude Code’s current model — that’s effectively the level of access being granted the moment a project is trusted.