High · published February 6, 2026
⚡ A crafty attacker could create a sneaky config file in Claude Code's sandbox, letting them run code with host privileges upon restart! 🔥 Think of it like a hotel room where the cleaning staff forget to lock the closet — it’s a prime spot for someone to stash a few surprises for later. If the room isn’t properly checked, the next guest (or in this case, the next session) can unwittingly unlock those surprises. This vulnerability allows malicious actors to inject persistent commands that execute with elevated privileges whenever Claude Code is restarted. If left unaddressed, this could lead to unauthorized access and manipulation of sensitive data, making it a significant risk for users and their systems.
Think of it like a hotel room where the cleaning staff forget to lock the closet — it’s a prime spot for someone to stash a few surprises for later. If the room isn’t properly checked, the next guest (or in this case, the next session) can unwittingly unlock those surprises. Prior to version 2.1.2, Claude Code's bubblewrap sandboxing didn’t properly guard the .claude/settings.json file when it was missing at startup, enabling code within the sandbox to create and exploit this file.
This vulnerability allows malicious actors to inject persistent commands that execute with elevated privileges whenever Claude Code is restarted. If left unaddressed, this could lead to unauthorized access and manipulation of sensitive data, making it a significant risk for users and their systems. Upgrade Claude Code to version 2.1.2 immediately to close this security hole. Additionally, review your configurations to ensure all sensitive files are correctly protected. Implement strict access controls where possible to safeguard against similar issues. This is fixable! Patch up and you’ll have Claude Code secure in no time. 🛡️