Latest news
Cybercrime
Hackers Can Hijack Claude Code MCP Traffic to Steal OAuth Tokens — No Patch Coming
8 June 2026 dark6
Researchers at Mitiga Labs demonstrated a five-step npm supply chain attack that rewrites ~/.claude.json to redirect Claude Code MCP traffic...
Vulnerability
Microsoft Warns: Claude Code GitHub Action Exploitable via Prompt Injection to Leak CI/CD Secrets
8 June 2026 dark6
Microsoft Threat Intelligence disclosed a prompt injection flaw in the Claude Code GitHub Action that allowed attackers to access /proc/self/environ...
Vulnerability
Claude Code’s Five-Month Network Sandbox Bypass Silently Exposed Developer Credentials and Source Code
21 May 2026 dark6
Anthropic's Claude Code harbored a critical SOCKS5 null-byte injection sandbox bypass for over five months, allowing attackers to silently exfiltrate...