Common Claude Code Misconfigurations

Running --dangerously-skip-permissions on a laptop, or through a shell alias.

Why it matters. Bypass mode skips every permission prompt and path check, so any injected instruction runs unchecked.

Fix. Remove the alias. Set permissions.disableBypassPermissionsMode: "disable" in managed settings. Use bypass only in a disposable, network-restricted container.

Production credentials within the agent's reach: .env files, cloud CLI credentials, database URLs, API tokens in unrelated files.

Why it matters. A Cursor agent found a Railway API token in an unrelated file and deleted a production database and its volume backups in about 9 seconds (PocketOS, via Cerbos).

Fix. Deny or mask credential files and variables in sandbox.credentials; add Read(./.env) deny rules; use separate development credentials; reach production only through break-glass access.

Sandbox off, or on with allowUnsandboxedCommands left enabled.

Why it matters. Indirect prompt injection reached code execution under auto mode in 60 to 80% of trials; Anthropic describes auto mode as "a convenience feature backed by a best-effort classifier, not a security guarantee" (Embrace The Red).

Fix. Set sandbox.enabled: true, allowUnsandboxedCommands: false and, in managed settings, sandbox.failIfUnavailable: true. On Linux and WSL2, install bubblewrap and socat.

A broad network allowlist: *, github.com, paste sites or webhook services.

Why it matters. Every allowed host is a possible exfiltration or command-and-control channel for an injected agent.

Fix. Allow only the registries and internal hosts you need; turn on strictAllowlist; organisations can set sandbox.network.allowManagedDomainsOnly.

No deny or ask rules for destructive and publishing commands.

Why it matters. Claude Code ran terraform destroy against a stale state file and deleted a production database and its automated snapshots; recovery depended on AWS support (DataTalks.Club).

Fix. Ask before git push, terraform, kubectl, npm publish and migrations; deny rm -rf and force-push.

Over-broad allow rules (Bash(*), Bash(sudo *), WebFetch) in user or project settings.

Why it matters. An allow rule turns any successful prompt injection straight into execution without a prompt.

Fix. Allow only specific safe commands. Organisations can set allowManagedPermissionRulesOnly.

Opening untrusted repositories on a host that holds your credentials.

Why it matters. Repository files have repeatedly been able to run code: CVE-2025-59536 (project config executed before the trust prompt), and the Miasma worm's SessionStart hook.

Fix. Open unknown code, forks and contractor repositories only in a dev container, VM or cloud session with no credentials.

Claude Code not updated, and no minimum version enforced.

Why it matters. The Claude Code repository lists 30 CVE advisories published since June 2025 (GitHub security advisories).

Fix. Update weekly and within days of an advisory. Organisations can set requiredMinimumVersion in managed settings.

Project .claude/settings.json or .mcp.json with hooks, MCP servers or allow rules committed without review.

Why it matters. Configuration committed to a repository is how the Miasma worm reached Claude Code users (StepSecurity).

Fix. Put CLAUDE.md, .claude/** and .mcp.json under CODEOWNERS; organisations can set allowManagedHooksOnly and allowManagedMcpServersOnly.

Unvetted MCP servers, unpinned versions, broad OAuth scopes, or enableAllProjectMcpServers: true.

Why it matters. In a proof of concept, an injected support ticket made a Cursor agent with Supabase service_role access copy secret tokens into the ticket thread (General Analysis).

Fix. Keep an approved MCP list; review scopes; pin versions; re-review on every update.

Plugins installed from unknown marketplaces, or sideloaded with CLI flags.

Why it matters. Plugins can bundle hooks, MCP servers and executables that run with your privileges.

Fix. Organisations can set strictKnownMarketplaces, disableSideloadFlags and disableCommandPluginSources, and run a private marketplace.

Untrusted issue or pull request text placed in CI agent prompts; the action not pinned by SHA; allowed_non_write_users: "*".

Why it matters. PR titles and comments hijacked the Claude Code Security Review action into leaking CI secrets (Comment and Control); the same pattern hit several AI actions (PromptPwnd, Aikido); claude-code-action trusted any actor ending in [bot], fixed in v1.0.94 (CSA research note).

Fix. Pin actions by SHA; keep actor checks; pass untrusted text as clearly delimited data; give review jobs read-only tokens.

The CI job that runs the agent also holds publishing or deploy credentials (NPM_TOKEN, deploy keys, id-token: write).

Why it matters. An issue title injected into Cline's triage workflow, which ran claude-code-action, led to stolen release tokens and a malicious cline@2.3.0 publish (Adnan Khan, Clinejection).

Fix. Split the agent job from the privileged job; publish with OIDC trusted publishing in the privileged job only; require environment approvals.

Headless (claude -p) or Agent SDK runs on shared hosts with ambient credentials.

Why it matters. The docs state: "Trust verification is disabled when running non-interactively with the -p flag" (Claude Code security docs).

Fix. One container per run: non-root, read-only root, an egress allowlist, explicit --allowedTools, and no ambient cloud credentials.

Auto mode treated as a safety boundary.

Why it matters. A shadowed standard-library module (struct.py) got past the auto mode classifier in 3 of 5 runs (Embrace The Red).

Fix. Keep the sandbox and deny rules under auto mode; disable auto mode for regulated repositories.

Backups and snapshots in the same account and blast radius as production.

Why it matters. The DataTalks.Club deletion removed the automated snapshots along with the database (DataTalks.Club).

Fix. Cross-account or immutable backups, deletion protection and point-in-time recovery.

Personal or consumer accounts used for company code; no SSO.

Why it matters. Consumer accounts sit outside company data terms, audit logs and managed policy.

Fix. Organisations can set forceLoginMethod and forceLoginOrgUUID, use SSO and SCIM, and block consumer endpoints at the proxy.

No telemetry, or telemetry developers can turn off.

Why it matters. Without telemetry, incidents are found by the victims, not by defenders.

Fix. Set the OpenTelemetry variables (CLAUDE_CODE_ENABLE_TELEMETRY, exporters, endpoint) in the managed env block so they cannot be overridden.

IDE extensions out of date, local listeners exposed, or the WebDAV service running on Windows.

Why it matters. CVE-2025-52882: older Claude Code IDE extensions ran an unauthenticated local WebSocket server any website could connect to, fixed in 1.0.24 (Datadog Security Labs); the docs recommend against enabling WebDAV or allowing \\* paths (security docs).

Fix. Update IDE extensions with the CLI; disable the WebClient service; never allow \\* paths.

No scope or stop conditions in CLAUDE.md; the agent is free to "find a way".

Why it matters. An agent told only to finish a task will use whatever it can reach, as the PocketOS and DataTalks.Club deletions show.

Fix. State in-scope systems, forbidden actions and "stop and ask" conditions in CLAUDE.md; gate automation triggers behind labels.

The agent's identity can push to any branch or open pull requests visible outside the team.

Why it matters. Anything the agent can push is visible to others before a person reviews it, and pushes can carry data out of the environment.

Fix. Branch rulesets that limit the agent to its own branch prefix; review before merge or public visibility; push-time secret scanning; Bash(git push *) under ask.

MCP servers that read content outsiders can write (error monitoring, tickets, chat, email) connected to an agent that can run commands.

Why it matters. Fake Sentry error events carrying "fix" instructions hijacked Claude Code, Cursor and Codex through an MCP server (Agentjacking, The Hacker News).

Fix. Read-only scopes; keep the sandbox and ask rules on while such a server is connected; never pair it with -p or auto mode.

One credential spans staging and production; no short-lived, task-scoped agent identity.

Why it matters. The PocketOS agent was working on a staging task when it used a token that could delete production (Cerbos).

Fix. Separate accounts and tokens per environment; short-lived credentials minted per task; production only through break-glass access.

Project SessionStart and other hooks allowed to run when a repository is opened.

Why it matters. The Miasma worm's Claude Code trigger was a SessionStart hook in .claude/settings.json (StepSecurity).

Fix. Read .claude/settings.json before opening; open unknown repositories in containers; organisations can set allowManagedHooksOnly.

Folder trust treated as a harmless click.

Why it matters. Accepting the trust prompt starts the project's MCP servers as native processes with your privileges, outside the sandbox; Anthropic treats the prompt as your consent (Adversa AI, TrustFall).

Fix. Never trust a folder before reading .mcp.json and its settings; organisations can set allowManagedMcpServersOnly; run headless jobs only in per-job containers.

Plugin auto-update on, with plugins pinned to marketplaces on git hosts outside GitHub.

Why it matters. A branch named like a pinned plugin commit could silently replace the plugin on auto-update; fixed in Claude Code 2.1.179 (AIR Security, Plugin4Shell).

Fix. Update to 2.1.179 or later; use marketplaces you control; review the auto-update setting.

Approval prompts relied on to show what a file edit really changes.

Why it matters. A symlink with a harmless name made the prompt show a decoy path while the write hit agent configuration (Adversa AI, SymJack); Wiz showed a related gap (GhostApproval).

Fix. A PreToolUse hook that resolves symlinks and blocks writes outside the project and to dotfiles, whatever path is displayed; sandbox filesystem limits.

Skill review that ends at a static scanner.

Why it matters. Obfuscated skills evaded static skill scanners in over 90% of attempts (Adversa AI, SkillCloak).

Fix. Allow skills only from known sources, and watch what they do at run time with hooks and telemetry; treat scanners as one layer.