Topic starter
01/08/2026 8:56 pm
TL;DR: Claude Code’s disclosed CVEs, source-code leak, and proof-of-concept reverse shell show how an agentic coding tool can turn repository content, configuration, and runtime permissions into an execution path for shell access and credential exfiltration, according to Akto. Static review alone cannot reliably govern tool-using AI systems; runtime visibility and behavioural controls now matter more than point-in-time checks.
Editorial analysis by NHI Mgmt Group, based on content published by Akto: “Claude Code Vulnerabilities: Deep Dive, Exploitation Paths and Proactive Defense”.
Key questions
Q: What breaks when agentic coding tools are allowed to trust repository content by default?
A: Trust breaks because repository files can behave like instructions once an agent reads them in context.
Q: When does runtime enforcement matter more than static permissions for AI agents?
A: Runtime enforcement matters whenever an agent can make contextual tool calls or change behavior after provisioning.
Q: What are the signs that an AI coding tool is being abused for code execution?
A: Look for unexpected writes to .vscode, shell startup files, task definitions, or repository-local binaries, especially when those changes follow reads from external content.
Practitioner guidance
- Disable auto-execution in untrusted contexts Turn off YOLO-style modes for repositories, forks and downloaded projects until a human has reviewed the content and its execution path.
- Isolate agent runtime permissions Run agentic coding tools in containers or VMs with tightly bounded shell access, network egress and filesystem write scopes.
- Harden project-load and startup flows Review trust dialogs, initialisation hooks and project-load behaviour so that configuration files cannot trigger execution before approval.
Bottom line: Claude Code’s disclosed weaknesses show that agentic coding tools can convert untrusted repository content into executable behaviour, which is a runtime governance problem rather than a code-quality problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 9:04 pm
Runtime control is now the governing boundary for agentic AI. Claude Code shows that the decisive security question is no longer whether a repository is clean at scan time, but whether an agent can be influenced into executing harmful actions after it has read untrusted content. Static review still has value, but only as a precondition check. Practitioners should treat execution-time policy as the primary control plane.
A few things that frame the scale:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
- Half of companies using generative AI will deploy agentic AI by 2027, according to Deloitte's 2025 Technology Predictions.
A question worth separating out:
Q: Should organisations block automated scans of forked repositories by default?
A: Yes, unless the repository is treated as untrusted input and approved manually first. Forks can contain indirect prompt injection in comments, docs or build files that an agent will read as instructions. If the scan tool can execute actions, the repository owner may be controlling the scanner’s behaviour, not just its input.
👉 Read our full editorial: Claude Code vulnerabilities show why agentic AI needs runtime controls