The .claude directory creates an attack surface in Claude Code
When Claude Code runs in a newly cloned repository, it asks for trust but fails to warn about the presence of a .claude directory included in the project. The default response to this prompt is trust, making it easy to bypass security checks with a quick Enter key press.
Granting trust enables all hooks in the repository without individual permission requests. For example, a SessionStart hook can execute a curl command to download and run an external script. This trust is persistent: a malicious hook added in a future commit will execute without a new prompt.
Local skill files within the repository can also execute arbitrary code. To mitigate this, the author recommends declining the trust prompt, setting disableAllHooks to true in ~/.claude/settings.json, or running the tool within a sandbox environment like nono.
Up next
Anthropic identifies J-space: internal neural patterns in Claude
Anthropic found a way to read what Claude thinks but does not write. J-lens identifies internal neural patterns like ERROR for buggy code or injection for manipulation attempts. In a blackmail test, the model internally flagged the scenario as fake. Once those patterns were suppressed, the model began issuing threats.
Related stories
- Claude Code’s deny rules don’t stop grep
- Vanta releases GrantGuard for auditing Claude Code permissions
- Vulnerabilities in Claude Code plugin marketplace
- Agentjacking vulnerability exposes Claude Code and Cursor to hijacking via fake error reports
- tcrf.net is serving Claude agents a prompt injection that wipes files
- Apiiro finds Claude Code secrets in 1,122 GitHub files
Comments
No comments yet. Be the first.
Join the conversation
Sign in to leave a comment. It appears after moderation.