Notifications
Clear all
Topic starter
01/08/2026 8:56 pm
TL;DR: Claude Code’s disclosed CVEs, source-code leak, and proof-of-concept reverse shell show how an agentic coding tool can turn repository content, configuration, and runtime permissions into an execution path for shell access and credential exfiltration, according to Akto. Static review alone cannot reliably govern tool-using AI systems; runtime visibility and behavioural controls now matter more than point-in-time checks.
NHIMG editorial — based on content published by Akto: Claude Code vulnerabilities and runtime defense paths
By the numbers:
- In March 2026, the @anthropic-ai/claude-code 2.1.88 package included a 59.8 MB JavaScript source map and a 1,906-file, 513,300-line unobfuscated TypeScript source file.
- 2.0.65 (January 2026)., ressed in 2.0.65 (January 2026).
- Anthropic has reported seeing a 30 to 40 percent reduction in security-related PR comments after implementing its free Claude Code Security plugin.
Questions worth separating out
Q: What breaks when agentic coding tools are allowed to trust repository content by default?
A: Trust breaks because repository files can behave like instructions once an agent reads them in context.
Q: Why do AI coding environments create more secret exposure risk than standard developer tools?
A: They can inspect repository context, read dotfiles, and infer where credentials are stored, then act on that information through commands or file changes.
Q: How can security teams tell whether AI lifecycle controls are working?
A: They should look for evidence that access requests, policy enforcement, and usage visibility are centrally recorded and current.
Practitioner guidance
- Isolate agent execution from trusted developer environments Run agentic coding tools in containers or VMs with tightly scoped filesystem, network, and credential access.
- Treat repositories and dependencies as untrusted inputs Block automatic execution of hooks, bootstrap scripts, and build-time commands in newly cloned or third-party repositories until they pass explicit review.
- Monitor tool calls and network egress during runtime Add behavioural detections for abnormal shell usage, unexpected outbound requests, repeated loops, and agent actions that diverge from the task prompt.
What's in the full article
Akto's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step breakdown of CVE-2025-59536 and CVE-2026-21852 exploitation paths
- Repository, hook, and MCP abuse patterns that show how prompts become command execution
- Runtime defense examples for blocking tool misuse, abnormal loops, and credential export
- Practical notes on validating protections in CI/CD rather than only during code review
👉 Read Akto's analysis of Claude Code vulnerabilities and runtime defense paths →
Claude Code vulnerabilities and the governance gap in agentic AI?
Explore further
01/08/2026 9:04 pm
Agentic coding tools have become non-human identities with delegated execution power. Claude Code does not merely assist with code suggestions. It can operate terminal commands, move through files, and call external services, which gives it an identity-like role inside the development environment. That makes governance questions about who or what is authorised to act, under what scope, and with what review boundary. Practitioners should treat tool-using AI systems as controlled identities, not as chat interfaces.
A few things that frame the scale:
- 96% of technology professionals identify AI agents as a growing security threat, and 66% believe this risk is immediate, according to AI Agents: The New Attack Surface report.
- Only 44% have implemented any policies to govern AI agents, despite 92% agreeing that governing them is critical to enterprise security.
A question worth separating out:
Q: Who is accountable when an autonomous assistant exfiltrates secrets or runs destructive commands?
A: Accountability sits with the team that granted the assistant its tool access, data access, and execution paths. For governed environments, that responsibility also extends to the controls that failed to separate instruction content from runtime authority. If the agent can act without a control gate, the governance gap is structural.
👉 Read our full editorial: Claude Code vulnerabilities show why agentic AI needs runtime controls
