Tego AI Reveals Second Claude Vulnerability in a Week: Hidden Links Covertly Transmit Files to Attackers

Key Findings

• Tego AI disclosed a second vulnerability in Anthropic's Claude ecosystem within one week, this time affecting Claude Code, the command-line coding tool
• A malicious repository can use symbolic links in a CLAUDE.md file to trick Claude Code into reading files outside the project directory and sending them to Anthropic's servers without user warning or approval
• The vulnerability exploits a gap in Anthropic's previous fixes—two similar flaws were patched in CVE-2025-59829 and CVE-2026-25724, but the same underlying flaw persists in the startup memory loader
• Anthropic closed the report as "Informative" rather than a security fix, arguing the "trust this folder" dialog already grants broad access permissions
• The issue reflects a broader authorization problem in enterprise AI agents: the current security model cannot distinguish between legitimate code execution and exfiltration of sensitive files

Background

Tego AI, a Tel Aviv-based security research firm, released this disclosure on July 24th, 2026, one week after reporting a separate flaw in Claude Tag, Anthropic's Slack integration. Both disclosures highlight gaps in how AI coding agents handle permissions and data access in enterprise environments.

How the Attack Works

When a developer clones a malicious repository and starts Claude Code, the tool reads the CLAUDE.md instruction file. If that file contains an @import directive pointing to a symbolic link, Claude Code follows the link to whatever file it resolves to—potentially files far outside the project directory, such as /etc/passwd or SSH keys.

The compromised file's contents get bundled into Claude Code's first request to Anthropic's servers before any user interaction occurs. No tool execution happens, no file-edit approval dialog appears, and no code runs on the attacker's end. Data simply leaves the developer's machine as part of the outbound request.

The attack works because Claude Code's security check validates the repository path (like ./link) rather than the actual file the link resolves to. The symbolic link itself is publicly visible on GitHub, making the attack mechanism transparent.

Previous Fixes Missed This Path

Anthropic has already addressed symbolic-link vulnerabilities twice. In CVE-2025-59829 and CVE-2026-25724, fixes were applied to the permission subsystem. Tego AI's research reveals the same defect survived in a third code path: the startup memory loader that runs before user interaction and directly sends data to the network.

This represents a pattern rather than an isolated bug—the same category of flaw keeps appearing in different parts of the codebase, suggesting incomplete understanding of where symbolic-link attacks could occur.

The Broader Authorization Problem

Tego AI's position isn't that Anthropic made a mistake, but that Anthropic's threat model itself is inadequate for enterprise adoption. A single "trust this folder" click currently grants Claude Code broad permissions to read, edit, and execute anything in that project.

According to Tomer Niv, Head of Research at Tego AI, the problem is timing and information: developers click "trust" before seeing what the repository actually does, and the dialog cannot distinguish between "run my build script" and "exfiltrate my credentials." In CI runners and standardized developer images, predictable file paths make sensitive data reliably accessible to malicious repositories.

For enterprise security teams adopting AI coding agents, this boundary is exactly what needs clearer definition.

Repository-Level Redirection Capability

The technical report also documents a separately known behavior: a repository-committed settings file can redirect Claude Code's outbound endpoint to any host chosen by the repository author. Combined with the file-reading vulnerability, this creates multiple exfiltration pathways.

Why This Matters for Enterprises

Both Tego AI disclosures raise the same core question: who or what is allowed to instruct the agent and access its connected systems? The Claude Tag research framed this around inbound Slack messages. This research frames it around ordinary Git operations that developers perform routinely without security scrutiny.

As enterprises scale AI coding agents across teams and CI pipelines, the current authorization model leaves too much responsibility on a single informed decision made at the least informed moment.

Sources

• https://securityonline.info/tego-ai-discloses-second-claude-flaw-in-a-week-hidden-link-silently-sends-files-to-attackers/
• https://hackread.com/tego-ai-discloses-second-claude-flaw-in-a-week-hidden-link-silently-sends-files-to-attackers/