Claude Code
16 articles
-
Claude CodeClaude Code's Allow Rule Is the Whole Command, Password Included
Apiiro found 2,539 real secrets in 1,994 public GitHub repos, most of them in .claude/settings.local.json, the file Claude Code writes when you pick "Yes, and don't ask again". On 2.1.319 the rule it saves is the full command string, PGPASSWORD= and bearer header included, with no prefix and no redaction. Claude Code keeps the file out of git with one line in the global excludes file in your home directory, not the repo, so a clone elsewhere stages it with git add -A, and once the file is tracked the exclude does nothing. When the file is already committed, Claude Code notices and prints that it is ignoring the file's allow rules until you trust the workspace, then appends the next approved command, token included, to the same tracked file.
-
Claude CodeClaude Code's Auto Mode Check Rides Inside Your Request
Claude Code 2.1.319 (6 November) runs auto mode's safety check inline. I captured the traffic: each agentic turn carries a safeguards block on the normal inference request, and the verdict comes back inside the same response's message_delta, not from a separate classifier call. That block ships the server your working directory, home directory, and the exact launch command. The same release removed the fallback to the built-in classifier when telemetry or feature flags are off or you sit behind an LLM gateway, so a proxy that buffers or rewrites the stream causes a denial, and claude -p now exits 1 where it used to exit 0.
-
Claude CodeClaude Code Sends 838 Bytes Where It Sent 193,000
Anthropic opened message threads on the Messages API as a public beta on 2 November 2026. Claude Code 2.1.319 already uses them by default on a claude.ai login against api.anthropic.com, with no changelog mention. Through a local logging proxy, a three-request Haiku 5.5 turn sent 185-198 KB per request stateless (about 575 KB total) and 189,090 then 839 and 838 bytes with threads (create, then continue with previous_message_id, no tools, a 111-byte billing-tag system block). Cached input tokens read were the same either way (72-74K), and at that context size median time to first byte was 1.12 s threaded vs 0.96 s stateless over eight requests each. The gate is first-party API only: off on Bedrock/Vertex/Foundry, behind any non-Anthropic ANTHROPIC_BASE_URL, and for ZDR and HIPAA orgs. Undocumented CLAUDE_CODE_TETHER_LIVE=0/1 switches it; CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS=1 also does but dropped deferred tool loading and produced a ~1.11M-token request on a machine with many MCP servers. Claude Code tracks the 5-minute lifetime itself: after 315 s idle it sent a full create (194,828 bytes, 11 messages) with no 404.
-
Claude CodeClaude Code Replaced Broken Configs With a 258-Byte Default
Claude Code 2.1.317, started headless (claude -p, or a subcommand such as claude mcp list), copies an unparseable ~/.claude.json to backups/, writes a 258-byte six-key default in its place and exits 1; the next start runs on the default with no MCP servers and no trusted folders and says nothing. Hands-on in a throwaway CLAUDE_CONFIG_DIR: a /* comment */, a file cut at 60%, an empty file, and an empty file with backups present all reset the same way; claude --version left the file alone; an interactive start under a pseudo-terminal showed the two-option dialog and left it alone; the restore hint named a planted empty newest backup; a backup of the broken file is written 7 ms after the .corrupted copy. On this Mac the file is 619 KB, 124 keys, 221 project entries (160 trusted), 8 user-scope MCP servers; five backups spanning ten hours. 12 parallel claude mcp add landed 12/12; four batches of 40 landed 159/160 with all 160 exiting 0 (srv35 printed Added and was missing). Timeline: 1.0.31 (20 June 2025) fixed the same reset; issues 69354 (18 June 2026, 2.1.142), 73590 (2 July, Windows, 45 .corrupted files) and 87551 (18 August, reproduced by claude[bot] on 2.1.234 within 32 minutes, labels data-loss + reproduced, closed stale by github-actions 20 September). 2.1.318 (npm 2026-11-03 21:55 UTC) cites #87551 and says the start now fails and leaves the file; six changelog lines about the file in total. 2.1.318 not run: auto-updater had not fetched it, the sandboxed session refused a direct download.
-
Claude CodeClaude Code Guards Your Email. Base64 Walks Right Past.
Claude Code 2.1.317 (npm 2026-11-02 23:57 UTC) adds a check that asks before a web or shell tool call sends the signed-in account's email address to the network. Hands-on: the check is a built-in plugin, cc-plugin-privacy (cc-plugin-privacy@builtin, absent from the 2.1.316 binary, not shown by claude plugin list, shown by claude plugin details), registered on tool.check for WebBrowser, WebFetch, WebSearch, Bash, Monitor, PowerShell and Tmux; it JSON-serialises the tool input, lowercases it, appends a once percent-decoded copy, looks for the session.identity() email, blanks it, and for the shell tools asks only if the rest matches /\b(curl|wget|https?|httpie|xh|nc|ncat|socat|telnet|ssh|scp|sftp|rsync|ftp|lftp|rclone|iwr|irm|invoke-webrequest|invoke-restmethod)\b/; it runs after the normal permission decision and turns an allow into an ask. Twenty headless Haiku 5.5 runs ($0.12) against a 127.0.0.1 capture server: a literal, upper-cased or %40-encoded address next to curl, a python3 urllib call with an http URL, a git push with the address in the URL and a WebFetch were all asked (denied headless); a different address, CLAUDE_CODE_USER_EMAIL, echo, git log --author and the Write tool passed; $(cat email.txt), base64, %2540 and a raw Python socket passed and the server received the address; enabledPlugins false via --settings switched it off, the same key in an untrusted repo's .claude/settings.json did not. The same build adds an unlisted sentence to the userEmail system prompt about sites that ask for a contact email in the User-Agent. Feature flag tengu_wise_newt defaults on; API-key sessions have no identity email so the check never fires (from the code, not run).
-
CursorCursor Served a Backdoored Claude Code Extension for 11 Hours
On 29 October 2026, between 09:27 and 20:35 UTC, Cursor's extension marketplace served tampered builds of Anthropic's Claude Code extension as Anthropic.claude-code 2.1.312 and 2.1.313 for macOS ARM64 and Windows x64, with a 7,386-byte loader prepended to extension.js that appends an SSH key tagged svc-telemetry, tries to enable Remote Login, opens a reverse tunnel to 134.209.82.225, installs a com.apple.sysmond LaunchAgent or a SysMon scheduled task, and beacons host details. Hands-on: Cursor's gallery at marketplace.cursorapi.com is an Open VSX mirror (links under /open-vsx-mirror/ redirect to cursor-cdn.com blobs, metadata is cached Open VSX JSON, every Claude Code package blob was rewritten on 30 October after the removal); Open VSX, npm and the Microsoft marketplace never had a 2.1.313; the 2.1.312 darwin-arm64 package Cursor serves today is byte-identical to Open VSX's, its Ed25519 signature verifies over the whole package, and its extension.js is 3,685,536 bytes, exactly 7,386 short of the tampered 3,692,922. Cursor's Marketplace Install Cooldown defaults to 0 hours and signature verification is an enterprise Team setting, while VS Code's extensions.autoUpdateDelay defaults to 12 hours, longer than the 11-hour window. Phorion's finding that the macOS enable step fails because systemsetup -getremotelogin exits 0 with an access error that never matches /Off/i. Local sweep on this Mac clean.
-
Claude CodeClaude Code's New Write Block Misses a printf Redirect
Claude Code 2.1.314 (30 Oct 2026) adds permissions.blockWritesOutsideWorkingDirectories. In 24 headless runs the Write and Edit tools refused every path outside the project, including through a symlink, in /tmp, and with Write(*) and Edit(*) allow rules that let the same write through when the setting was off. A printf redirect in Bash to the same folder went through, because the shell redirect check consults Edit rules and working directories, not this block. Side effects: settings.json in any .claude folder becomes a hard refusal, EnterWorktree and ExitWorktree disappear from the tool list, repository-supplied additionalDirectories don't count, 2.1.312 ignores the key silently. Auto-memory and the session's plan file still save. The settings reference has no entry yet.
-
Claude CodeClaude Code Reroutes Your Pinned Sonnet ARN to Opus 4.8
Claude Code 2.1.312 (27 Oct 2026) extends its post-refusal model switch to model names it doesn't recognise, so a flagged session on a Bedrock application inference profile ARN now moves to a region-prefixed Opus 4.8 ID (Opus 5 for bio and frontier_llm) for the rest of the session, at 2.5x Sonnet's list price if the profile fronted Sonnet 5.5. On 2.1.311 the refusal stood. The same release cuts the ARN's first request from 27,204 to 5,917 characters of system prompt and 46,609 to 30,326 characters of tool definitions. Tested with 34 headless runs against a local fake Bedrock and Anthropic endpoint; modelOverrides, availableModels, ANTHROPIC_DEFAULT_OPUS_MODEL, switchModelsOnFlag and the two CLAUDE_CODE_DISABLE_REFUSAL_* variables are the controls that worked, ANTHROPIC_DEFAULT_SONNET_MODEL is not.
-
SecurityA Web Page Can Plant an AGENTS.md in Your Downloads
On 22 October Forever Security described stopping a coding agent on a customer's machine as it installed the malicious npm package function-color on the instructions of an AGENTS.md in ~/Downloads that nobody had put there; their proof of concept is a web page that saves such a file into Downloads with no click, and BleepingComputer found Chrome, Edge and Firefox do it while only Brave asks. With a harmless canary AGENTS.md in my own Downloads folder, Codex 0.164.0 injected the file only when Downloads itself was the working directory (session rollouts confirm it), while Claude Code 2.1.310 loaded it from Downloads, from a plain subfolder and from a subfolder with its own git repository, because it walks every directory from the working directory to the filesystem root; a repository unzipped into Downloads inherits the planted file. Loading was deterministic but obedience was not (Haiku 3 of 6, Codex 1 of 2). For Claude Code a claudeMdExcludes glob, --setting-sources user, the Project instructions setting, or a project CLAUDE.md kept the file out. Nothing is patched because both agents are reading instruction files exactly as documented.
-
Claude CodeClaude Code's Sandbox Ran Your Shell Config Outside It
On Wednesday 22 October Claude Code 2.1.309 fixed sandboxed Bash commands running the shell's startup files outside the sandbox before each command. On 2.1.308 every sandboxed command started as an unsandboxed /bin/zsh -c that sourced ~/.zshenv with full access in the project directory, so a .env a sandboxed command wrote was executed with full access on the next Bash call; verified on macOS with an instrumented ZDOTDIR, canary file in the home directory on 2.1.308, denied on 2.1.309 and 2.1.310. The same release stopped sandboxed commands editing the file passed with --mcp-config (appendable on 2.1.308, operation not permitted on 2.1.310). Monday's 2.1.305 added sandbox.allowNestedUserNamespaces, which the docs say turns off a security boundary, and Thursday's 2.1.310 fixed Windows PreToolUse and PermissionRequest hooks letting calls through when Git Bash is missing. The per-session shell snapshot still runs your login shell outside the sandbox at a session's first Bash command, with the project as its working directory, so a leftover .env still runs there on 2.1.310.
-
Claude CodeClaude Code Compacts Idle Chats, and Has Since September
On 14 October the Claude Code 2.1.299 changelog documented idle compaction: a 200K+ token terminal conversation left idle for about 54 minutes is summarized before its one-hour prompt cache expires. The behavior had been live since 2.1.286 on 30 September through a server-side flag, the idleCompaction opt-out shipped in 2.1.290 on 5 October without a changelog line and was documented by a user reading the binary, and the /config row came in 2.1.302 on 16 October. At Opus 5.5 list prices it trades a $1.60 cold rebuild of a 200,000-token prefix for a $0.04 cache read and a roughly $0.40 summary, runs only on the one-hour TTL that subscribers get within plan usage, summarizes away path-scoped rules, nested CLAUDE.md files and hook-injected context, and records itself as trigger auto, so a PreCompact hook can only tell it from a context-limit compaction by checking the transcript's age.
-
AgentsThe Agent Will Stop When Your Tests Say So
Claude Code now ships more than twenty lifecycle hooks. One lets you refuse to let the agent finish until your test suite passes. The control you want lives in the event system, not the system prompt, and the surface moved a lot this month.
-
Claude CodeFrom Claude.ai to Claude Code in Ten Minutes
Everything you know from Claude.ai maps directly to Claude Code. Artifacts become real files. Projects become CLAUDE.md.
-
AnthropicClaude Code Hit $1 Billion Faster Than Slack or Zoom
Claude Code reached $1 billion in annualized revenue in six months, faster than ChatGPT, Slack, or Zoom. A terminal tool outpaced every enterprise product in history, and the reasons why should worry every SaaS vendor.
-
AI CodingYour AI coding bill is about to get weird
AI coding tools went from productivity boost to significant line item. Cursor credits burn in two weeks, GPT-5.4 context costs double past 272K tokens, and most engineering budgets haven't caught up.
-
AI CodingThe AI Coding Tools Landscape in 2026: Nobody Picks Just One Anymore
Developers now run an average of 2.3 AI coding tools simultaneously. The question shifted from 'which one?' to 'which ones, and for what?' Here's how the tool stack concept reshapes how we write code.