Executive brief
Claude Code is an AI-powered terminal tool that helps developers write and execute code. When started in a new directory, the tool asked users to confirm they trust files in that folder, but the confirmation dialog did not clearly explain that accepting would allow Claude Code to automatically execute any files in that directory without further prompts. An attacker could trick users into opening untrusted folders containing malicious code, leading to arbitrary code execution on the developer's machine.
Technical details
This vulnerability stems from an insufficient security warning (CWE-94: Improper Control of Generation of Code) in the startup flow. When Claude Code initializes in a new directory, it presents a trust dialog asking "Do you trust the files in this folder?" but the warning did not adequately document that selecting "Yes, proceed" grants the tool permission to execute arbitrary files in that directory without additional user confirmation. The attack vector is network-based via social engineering: an attacker can distribute a directory containing malicious code and trick a user into opening it with Claude Code. Since user interaction (clicking "Yes") is required and the tool must be explicitly invoked, the attack requires some preconditions, but the impact is high—successful exploitation results in arbitrary code execution with the user's privileges. The vendor has patched this by updating the warning message to clarify the implications of the trust decision, with the fix released in version 1.0.87.
Affected products
- Anthropic Claude Code < 1.0.87
Timeline
- 2025-09-03: disclosed
- 2025-09-03: patched: Fixed in version 1.0.87