TEL AVIV, Israel, July 24, 2026 (ZM NEWSWIRE) — One week after disclosing that Anthropic’s Claude Tag Slack integration could be driven by plain “@Claude” text, Tego AI today published a second piece of research on the Claude ecosystem. This one focuses on Claude Code, Anthropic’s agentic command-line coding tool.
Cloning an ordinary repository and starting Claude Code can cause the tool to read a file from outside the project and include it in the model’s first request, without a warning or approval prompt the user would recognize.
The technique is ordinary, and that is part of why it matters. A repository can commit a normal-looking instruction file, CLAUDE.md, whose @import directive points to a symbolic link. When a developer clones the repository and starts Claude Code, the tool follows the link to whatever file it resolves to, including files well outside the project, and folds that file’s contents into the first request it sends to the model.
No tool call fires, and no file-edit approval appears. The dialog Claude Code uses to catch out-of-project reads does not appear either, because it checks the in-repository link name, such as ./link, rather than the external file the link resolves to.
The whole delivery mechanism is a repository file named link that GitHub itself labels as a symbolic link pointing to /etc/passwd2, visible to anyone browsing the repository.
“Context is whatever gets sent to the model, and the model is a network endpoint like any other,” said Tomer Niv, Head of Research at Tego AI. “So this is not a file that quietly sits in a prompt. Clone a repo, answer the same ‘trust this folder?’ question you always answer, and a file from outside that repo can leave your machine on the first request, with no code execution, no cooperation from the model, and no server the attacker has to run.”
The result is that the out-of-project file’s contents appear inside the request body Claude Code sends when the session starts. The data leaves the local machine as part of the outbound request, rather than remaining only in local model context.
https://www.youtube.com/embed/Et0hZI34NUM
Anthropic has already fixed this underlying class of flaw twice. What makes the new report notable is where the flaw sits, not that the pattern is new.
The same failure, a security check reading one path while the filesystem follows a symbolic link to another, previously appeared in Claude Code and was fixed correctly in CVE-2025-59829 and CVE-2026-25724. Both were reported through HackerOne and resolved in the permission subsystem.
Tego AI’s research shows that the same defect remained present on a third code path, the startup memory loader, which those fixes never reached. That path is also the one that places what it finds onto the network before the model has taken any action.
The technical write-up also documents that a repository-committed settings file can redirect Claude Code’s outbound endpoint to a host chosen by the repository author, a separately known behavior. The exposed file only needs to be readable by the developer’s own account. That is a realistic condition in CI runners, containers, and standardized developer images, where sensitive file paths are often predictable.
Tego AI’s point is about that security boundary rather than a single bug. The company reported the issue to Anthropic through HackerOne in July 2026, and Anthropic closed it as Informative.
Anthropic’s rationale was consistent and clearly stated: under the Claude Code threat model, the “trust this folder” dialog is the security boundary, and accepting it already grants a project broad read, edit, and execute access. Tego AI does not dispute that Anthropic applied its stated model consistently.
“We understand the model. Our disclosure is an argument about its terms,” Niv said. “A single ‘trust this folder’ click is being asked to carry an enormous amount of weight, at the least informed moment possible, before you have seen anything the repository does. It cannot tell the difference between ‘run my code’ and ‘read my SSH key and mail it out,’ and in many real setups that click was inherited from a parent directory and never actually shown for the repository in question. As enterprises adopt AI coding agents, that is exactly the boundary they need to be able to reason about.”
The disclosure continues a theme in Tego AI’s research: for enterprise AI agents, the unresolved question is authorization, meaning who, or what, is allowed to instruct the agent and reach its data and connected systems. The Claude Tag research raised that question about an inbound Slack message. This research raises it about an ordinary Git clone.
Tego AI notes that symbolic-link attacks are decades old and that Anthropic has repeatedly hardened Claude Code against them in good faith. The company published the write-up so users and security teams can reason accurately about what “trust this folder” grants in practice.
Tego AI confirmed the behavior against Claude Code v2.1.x.
The full technical report is available at: https://tego.ai/blog/a-hidden-project-link-can-make-claude-code-silently-send-your-files-to-an-attacker
About Tego AI
Tego AI is a cybersecurity company developing runtime security and control technology for enterprise AI agents. Its platform helps organizations monitor agent activity and stop unauthorized or risky actions before agents access sensitive data or connected systems.
The company operates in stealth. This is its second public security disclosure in a week. According to Tego AI, there is more to come.
Contact
CTO
Tal Melamed
Tego AI
tal@tego.ai
