Claude Code reads files before you approve anything

Clone a repo, run your coding agent, and a file from somewhere else on your disk goes out with the first request. Security firm Tego AI disclosed a flaw in Claude Code today where a symlinked @import inside a repo's CLAUDE.md gets followed at startup and folded into the model's context — no tool call, no file-edit approval, no out-of-project warning. It's their second Claude Code disclosure in a week, and the interesting part isn't the bug. It's that Anthropic doesn't consider it one.

What actually happened

The mechanism is dull, which is why it works. A repository commits an ordinary-looking CLAUDE.md with an @import directive pointing at a symbolic link checked into the project. The link resolves to something outside the project — say, a credentials file in your home directory. When a developer clones the repo and starts Claude Code, the startup memory loader follows the link and includes the target's contents in the first request it sends.

The approval dialog that's supposed to catch out-of-project reads doesn't fire, because it inspects the in-repo link name (./link) rather than the path it resolves to. Nothing executes. No tool runs. The data is simply in the request body, already on the wire. Tego reports the flaw on Claude Code v2.1.x, and notes Anthropic patched related issues previously under CVE-2025-59829 and CVE-2026-25724 — but the startup memory loader is a third code path those fixes never reached.

Tego says it reported through HackerOne in July and Anthropic closed it as Informative: under Claude Code's threat model, the "trust this folder" dialog is the security boundary. That's a defensible position and also a load-bearing one. Tego's Tomer Niv put the counter-argument plainly: context is whatever gets sent to the model, and the model is a network endpoint.

Why this matters for your business

Both parties are right, which is the problem. If you trust a folder, you've granted the agent read access — that's the documented contract. But most developers read "trust this folder" as "let it work here," not "let it ship arbitrary local files to a third party on launch." The gap between those two readings is where your .env lives.

Practically: treat cloning a repo and starting an agent in it as running untrusted code, because in terms of data egress it is. Client repos, contractor handoffs, that dependency you forked from GitHub — all of it. Run agents on repos you didn't write inside a container or a VM with nothing else mounted. Keep secrets out of the filesystem the agent can reach; a secrets manager the agent must explicitly call is auditable, a .env two directories up is not. And grep for @import and symlinks in any CLAUDE.md or AGENTS.md that arrived from outside your team.

This is what agent security looks like now. Not exploits — configuration you accepted at a prompt you didn't read closely.

Sources: Hackread, The Security Ledger.