Executive brief
Claude Code is an AI-powered coding assistant that can execute commands and fetch web data. A security flaw allowed the tool to access any page on HuggingFace without asking for user permission. An attacker could trick the AI into sending sensitive information—like your private files or environment variables—to a server they control by disguising the data transfer as a simple file download.
Technical details
Claude Code (versions 0.2.54 to 2.1.163) pre-approved the 'huggingface.co' hostname for its WebFetch tool without path restrictions. This permissive allowlist (CWE-183) allows an attacker who can inject untrusted content into the AI's context window to force the agent to make requests to attacker-controlled HuggingFace repositories. Because HuggingFace logs these requests as downloads, an attacker can encode sensitive local data (files, environment variables, or command outputs) into the request paths, effectively creating a covert storage channel (CWE-515) for exfiltration. The vulnerability is fixed in version 2.1.163.
Affected products
- Anthropic AI Claude Code >= 0.2.54, < 2.1.163
Timeline
- 2026-06-13: advisory: GitHub advisory published by Anthropic AI
- 2026-06-23: disclosed: NVD publication date
- 2026-06-13: patched: Fixed in version 2.1.163