Executive brief
The Anthropic Claude SDK for Python, which allows developers to integrate AI capabilities into their applications, contained a flaw in how it stored local data. This vulnerability could allow other users on the same computer or server to read or modify the AI's memory files, potentially exposing sensitive conversation history or allowing an attacker to manipulate the AI's future behavior. This is particularly relevant in shared hosting or certain containerized environments where file permissions are not strictly enforced by default.
Technical details
The local filesystem memory tool in the Anthropic Python SDK (both synchronous and asynchronous implementations) created files with mode 0o666. In environments with permissive umasks, such as many Docker base images or shared hosting environments, this resulted in files being world-readable or world-writable. A local attacker with low privileges could exploit this to read persisted agent state or modify memory files to influence model behavior (prompt injection/state manipulation). The vulnerability was addressed in version 0.87.0 by changing the file creation mode to 0o600 (owner read/write only) and updating directory creation to 0o700.
Affected products
- Anthropic Claude SDK for Python (anthropic) >= 0.86.0, < 0.87.0
Timeline
- 2026-03-31: disclosed
- 2026-03-31: patched: Fixed in version 0.87.0
- 2026-03-31: advisory