AI's Trust Deficit: A 'Silent' Flaw in Claude Code Asks Who's in Control

TEL AVIV, Israel – July 24, 2026 – For a developer, it’s a routine action, repeated dozens of times a week: clone a code repository from GitHub and open it in a local tool. But according to new research, this simple act could broadcast their private files—SSH keys, cloud credentials, configuration files—across the internet. The culprit is not a virus or a piece of malware in the traditional sense, but a subtle flaw within an increasingly popular AI coding assistant, Anthropic's Claude Code.

Cybersecurity firm Tego AI today disclosed its second major finding in the Claude ecosystem in as many weeks. The research demonstrates how a malicious, yet ordinary, code repository can trick Claude Code into reading a file from outside the project and silently exfiltrating its contents. The discovery moves beyond a simple bug report, striking at the heart of the security models underpinning the AI agents that enterprises are rushing to adopt. It raises a critical question for business leaders: in the age of AI, what does it truly mean to “trust” your tools?

The Anatomy of a Silent Breach

The attack vector identified by Tego AI is elegant in its simplicity and alarming in its implications. It relies on a decades-old technique known as a symbolic link, or “symlink”—essentially a shortcut that points from one file location to another. An attacker can commit a normal-looking repository to a public platform like GitHub, but include a symlink that points to a sensitive file on a developer's machine, such as ~/.ssh/id_rsa or /etc/passwd.

When a developer clones this repository and starts a Claude Code session, the tool’s “startup memory loader” immediately begins preparing the project's context for the AI model. In doing so, it follows the symlink, reads the contents of the sensitive external file, and bundles that data into the very first network request it sends to Anthropic’s servers. The data leaves the machine before the developer has typed a single command and before the AI model has taken any action.

Crucially, this happens without any of the warnings a user might expect. No tool call is executed, no file-edit approval prompt appears, and even the dialog designed to catch out-of-project file reads fails to trigger. The security check validates the path of the link itself (e.g., ./link_to_secrets), which is safely within the project, but fails to check the ultimate destination of that link, which lies far outside.

“Context is whatever gets sent to the model, and the model is a network endpoint like any other,” said Tomer Niv, Head of Research at Tego AI. “So this is not a file that quietly sits in a prompt. Clone a repo, answer the same 'trust this folder?' question you always answer, and a file from outside that repo can leave your machine on the first request, with no code execution, no cooperation from the model, and no server the attacker has to run.”

A Pattern of Patchwork Security

This is not the first time Anthropic has battled symbolic link vulnerabilities in Claude Code. The company has previously issued fixes for two similar flaws, tracked as CVE-2025-59829 and CVE-2026-25724. Those patches correctly hardened the tool’s permission subsystem. However, Tego AI’s research reveals that those fixes never reached a third, critical code path: the startup memory loader.

This gap highlights a systemic challenge for the entire industry. As AI platforms grow in complexity and evolve at a breakneck pace, ensuring that security fixes are applied comprehensively across all code paths is a monumental task. For businesses relying on these tools, the discovery of a recurring vulnerability in a different part of the application suggests that current security validation practices may be lagging behind development. It’s a pattern of patchwork security that leaves enterprises exposed, where fixing one hole leaves another, just a few feet away, wide open.

The 'Trust This Folder' Fallacy

The most significant aspect of this disclosure is not the bug itself, but the philosophical disagreement it exposes about the nature of security for AI agents. Anthropic, after reviewing Tego AI’s report, closed the issue as “Informative.” Their rationale is that the “trust this folder” dialog—a common feature in modern code editors—serves as the definitive security boundary. In their view, once a user consents to trust a project, they accept the risks of what it might do.

Tego AI argues this model is dangerously outdated. “We understand the model. Our disclosure is an argument about its terms,” Niv stated. “A single 'trust this folder' click is being asked to carry an enormous amount of weight, at the least informed moment possible, before you have seen anything the repository does.”

For enterprise leaders, this is the crux of the issue. The “trust” dialog is a binary, all-or-nothing decision that cannot distinguish between a project that needs to run code and one that intends to “read my SSH key and mail it out,” as Niv puts it. In many real-world development workflows, developers suffer from “click fatigue,” and that trust prompt may have been inherited from a parent directory, meaning it was never even shown for the malicious repository in question. This flimsy boundary is simply not sufficient for organizations where a single compromised developer machine can lead to a catastrophic breach of intellectual property or customer data.

Beyond the Bug: The Crisis of AI Authorization

This latest disclosure, following Tego AI's research into a flaw in the Claude Tag Slack integration, paints a broader picture of a technology landscape grappling with a fundamental new challenge: authorization. The unresolved question for enterprise AI is not just what the user can do, but what the agent can be instructed to do, and by whom. A malicious Git repository, like a carefully crafted Slack message, is a new vector for instructing an AI to perform unauthorized actions.

As companies integrate these powerful agents deeper into their workflows, they are creating new, poorly understood attack surfaces. The responsibility for securing these agents cannot rest on a single, ambiguous click from an unsuspecting developer. It requires a new paradigm of runtime security, granular permissions, and continuous monitoring—the very technologies Tego AI is developing while operating in stealth.

The debate ignited by this vulnerability is a necessary one. It forces the industry to confront the reality that the security models of the past are inadequate for the AI-powered future, demanding a more sophisticated approach to ensure that the tools meant to build the future of work don't become the instruments of its downfall.