It wasn’t a one-off
Adversa AI reviewed ten documented attacks on Claude Code from September 2025 to September 2026: one ran in the wild (Miasma), two received CVEs, and four were declined by the vendor (Adversa AI). Several work like Miasma:
- TrustFall: accepting the folder-trust prompt starts the project’s MCP servers as native processes with your privileges, outside the sandbox. Anthropic declined it, treating the prompt as your consent (Adversa AI).
- SymJack: a harmlessly named symlink points at the agent’s own configuration, so the approval prompt shows the decoy while the write lands on the real target. It worked against six coding agents (Adversa AI), and Wiz reported a related gap, GhostApproval (Wiz).
- Plugin4Shell: on git hosts that accept 40-character hexadecimal branch names, a branch named like a pinned plugin commit could replace the plugin on auto-update. It was fixed in Claude Code 2.1.179 (AIR Security).
- Agentjacking: fake Sentry error events carrying “fix” instructions hijacked Claude Code, Cursor and Codex through an MCP server (The Hacker News; The Next Web).