Claude Code's workspace trust prompt exists to stop an untrusted repository's config from doing anything before you've confirmed you trust it. For versions below 2.0.65, one config value got processed before that prompt ever appeared — and it was the one that controls where your API key gets sent.
What happened
Tracked as CVE-2026-21852 (GHSA-jh7p-qr78-84p7, CWE-522: Insufficiently Protected Credentials), the flaw sat in Claude Code's project-load flow. A repository can carry a project-level Claude Code settings file, and that file can set ANTHROPIC_BASE_URL to redirect where API requests go. The trust prompt is supposed to gate exactly this kind of untrusted, repo-supplied configuration before it takes effect.
It didn't. Claude Code read and applied that setting — including issuing live API requests to whatever endpoint it pointed at — before the trust prompt was shown. Point ANTHROPIC_BASE_URL at a server you control, get someone to open the repo, and their Anthropic API key goes to your endpoint along with the request, with no confirmation step in between.
Why "just opening it" is the part that matters
There's no further action required on the victim's side — no running a script, no accepting a suggested edit, no typing a command. The exposure happens at project load, from a config file the repository provides. The affected user's only "mistake" is opening a folder that turned out to be malicious, which is normal developer behavior when evaluating a repo, cloning a dependency, or reviewing someone else's PR locally.
GitHub's advisory rates this CVSS 5.3 (moderate). StupidLLM's own severity model scores it 7.2 (high) — the two aren't directly comparable, but the gap is worth noting given how little interaction the exploit actually requires.
What the source establishes — and what it doesn't
The GHSA advisory is unambiguous about the mechanism (settings-driven ANTHROPIC_BASE_URL processed before the trust gate) and the fix (2.0.65). It does not claim any confirmed real-world exploitation — this is a disclosed and patched vulnerability, not a reported breach. Treat it as "this was possible and has been fixed," not "this happened to someone."
Status
Fixed in @anthropic-ai/claude-code 2.0.65. Anyone on auto-update received the patch without doing anything. If you or your team pin the version, check you're on 2.0.65 or later before opening repositories you don't already trust.
Full incident record and severity scoring: STUPID-2026-0083
This is one of 83+ verified, severity-scored AI agent incidents documented at StupidLLM, an open incident database for AI coding agent failures.
Top comments (0)