Tel Aviv, Israel, July 24th, 2026, CyberNewswire<\/strong><\/p>\n One week after disclosing that Anthropic\u2019s Claude Tag Slack integration could be driven by plain \u201c@Claude\u201d text,<\/a> Tego AI today published a second piece of research on the Claude ecosystem. <\/p>\n This one focuses on Claude Code<\/strong>, Anthropic\u2019s agentic command-line coding tool.<\/p>\n Cloning an ordinary repository and starting Claude Code can cause the tool to read a file from outside the project and include it in the model\u2019s first request, without a warning or approval prompt the user would recognize.<\/p>\n The technique is ordinary, and that is part of why it matters. A repository can commit a normal-looking instruction file, CLAUDE.md<\/em>, whose @import<\/em> directive points to a symbolic link. <\/p>\n When a developer clones the repository and starts Claude Code, the tool follows the link to whatever file it resolves to, including files well outside the project, and folds that file\u2019s contents into the first request it sends to the model.<\/p>\n No tool call fires, and no file-edit approval appears. The dialog Claude Code uses to catch out-of-project reads does not appear either, because it checks the in-repository link name, such as .\/link<\/em>, rather than the external file the link resolves to.<\/p>\n The whole delivery mechanism is a repository file named link<\/em> that GitHub itself labels as a symbolic link pointing to \/etc\/passwd2<\/em>, visible to anyone browsing the repository.<\/p>\n \u201cContext is whatever gets sent to the model, and the model is a network endpoint like any other,\u201d said Tomer Niv, Head of Research at Tego AI<\/strong>. \u201cSo this is not a file that quietly sits in a prompt. <\/p>\n Clone a repo, answer the same \u2018trust this folder?\u2019 question you always answer, and a file from outside that repo can leave your machine on the first request, with no code execution, no cooperation from the model, and no server the attacker has to run.\u201d<\/p>\n The result is that the out-of-project file\u2019s contents appear inside the request body Claude Code sends when the session starts. <\/p>\n The data leaves the local machine as part of the outbound request, rather than remaining only in local model context.<\/p>\n Anthropic has already fixed this underlying class of flaw twice. What makes the new report notable is where the flaw sits, not that the pattern is new.<\/p>\n The same failure, a security check reading one path while the filesystem follows a symbolic link to another, previously appeared in Claude Code and was fixed correctly in CVE-2025-59829 and CVE-2026-25724. <\/p>\n Both were reported through HackerOne and resolved in the permission subsystem.<\/p>\n Tego AI\u2019s research shows that the same defect remained present on a third code path, the startup memory loader, which those fixes never reached. <\/p>\n That path is also the one that places what it finds onto the network before the model has taken any action.<\/p>\n The technical write-up also documents that a repository-committed settings file can redirect Claude Code\u2019s outbound endpoint to a host chosen by the repository author, a separately known behavior. <\/p>\n The exposed file only needs to be readable by the developer\u2019s own account. <\/p>\n That is a realistic condition in CI runners, containers, and standardized developer images, where sensitive file paths are often predictable.<\/p>\n Tego AI\u2019s point is about that security boundary rather than a single bug. The company reported the issue to Anthropic through HackerOne in July 2026, and Anthropic closed it as Informative.<\/p>\n Anthropic\u2019s rationale was consistent and clearly stated: under the Claude Code threat model, the \u201ctrust this folder\u201d dialog is the security boundary, and accepting it already grants a project broad read, edit, and execute access. <\/p>\n Tego AI does not dispute that Anthropic applied its stated model consistently.<\/p>\n \u201cWe understand the model. Our disclosure is an argument about its terms,\u201d Niv said. \u201cA single \u2018trust this folder\u2019 click is being asked to carry an enormous amount of weight, at the least informed moment possible, before you have seen anything the repository does. <\/p>\n It cannot tell the difference between \u2018run my code\u2019 and \u2018read my SSH key and mail it out,\u2019 and in many real setups that click was inherited from a parent directory and never actually shown for the repository in question. <\/p>\n As enterprises adopt AI coding agents, that is exactly the boundary they need to be able to reason about.\u201d<\/p>\n The disclosure continues a theme in Tego AI\u2019s research: for enterprise AI agents, the unresolved question is authorization, meaning who, or what, is allowed to instruct the agent and reach its data and connected systems. <\/p>\n The Claude Tag research raised that question about an inbound Slack message. This research raises it about an ordinary Git clone.<\/p>\n Tego AI notes that symbolic-link attacks are decades old and that Anthropic has repeatedly hardened Claude Code against them in good faith. <\/p>\n The company published the write-up so users and security teams can reason accurately about what \u201ctrust this folder\u201d grants in practice.<\/p>\n Tego AI confirmed the behavior against Claude Code v2.1.x.<\/p>\n The full technical report is available at: https:\/\/tego.ai\/blog\/a-hidden-project-link-can-make-claude-code-silently-send-your-files-to-an-attacker<\/a><\/p>\n Tego AI is a cybersecurity company developing runtime security and control technology for enterprise AI agents. <\/p>\n Its platform helps organizations monitor agent activity and stop unauthorized or risky actions before agents access sensitive data or connected systems.<\/p>\n The company operates in stealth. This is its second public security disclosure in a week. According to Tego AI, there is more to come.<\/p>\n CTO<\/strong><\/p>\n Tal Melamed<\/strong><\/p>\n Tego AI<\/strong><\/p>\n tal@tego.ai<\/strong><\/p>\n \n The post Tego AI Discloses Second Claude Flaw in a Week: Hidden Link Silently Sends Files to Attackers<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n![\"\"](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiuiqhE01dVJ1k9R3InG_t8uHFej5_MA3cGqYhvM2m3_kx_I65nWIh9YbJ4NlmxNRJM3Iaeh9pKKKH3ZjMQtlyARSQf_3Btcc1Jd2Qxykm3iZI1CCq-KcUfjoPREZex774FbLnghCNUnflbjng5xetEq9QYJMtJeUUR50qYhrKmVTCHdHgqmaJ5iur95HM\/s1600\/PR1.webp?ssl=1\")
<\/figure>\n![\"\"](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiUr0UD_WBnKuRBv1stTo2zHhsl89NtstWcp7pg2bRkF9XprrJ7XIYigWL5hw0iKbMOSxJL9Yop_Ln5JuhKy38tw35_cLDnpAZqYjdUquhPJFZLSTori1_4zgiOo-iBIJGtnWb_8X5e8qrSQrs9mCdAcPLnngkE06xWKy35s_n330v2XUiBl7X9DNIqtLs\/s1600\/PR2.webp?ssl=1\")
<\/figure>\nAbout Tego AI<\/strong><\/h2>\n
Contact<\/strong><\/h2>\n