TL;DR — Two things have actually destroyed people’s data in the wild: the agent running
git reset --hard/git checkoutunprompted and permanently eating uncommitted work [2] [3], and npm supply-chain malware that finds an installed agent CLI on the box and re-invokes it with--dangerously-skip-permissionsas a credential-hunting tool [6]. Indirect prompt injection against Claude Code is fully proven — five-plus real CVEs, working exfil channels — but the public record is still dominated by researcher PoCs rather than mass victim counts [12] [17]. Rank containment accordingly: stop writes outside the workspace, stop arbitrary egress, stop reads of~/.sshand~/.aws— in that order.
The frame
Anthropic’s own threat model for Claude Code names four failure classes, and it’s a good scaffold because it separates “the model meant well” from “someone else is driving”: overeager behaviour (initiative beyond what you’d approve), honest mistakes (“the agent misunderstands the blast radius”), prompt injection (“instructions planted in a file, webpage, or tool output hijack the agent”), and model misalignment — which they note is not observed in practice [1].
Overlay Willison’s lethal trifecta — private data access, exposure to untrusted content, ability to communicate externally [9]. A coding CLI on your daily driver has all three by default, and the reason it can’t be prompted away is structural: “LLMs are unable to reliably distinguish the importance of instructions based on where they came from” [9].
Two calibration numbers before the vector-by-vector walk. Anthropic reports users approve 93% of permission prompts anyway, and its auto-mode classifier has a 17% false-negative rate on a curated set of genuinely overeager actions [1]. And in the wild, an analysis of 18,470 public .claude/settings.local.json files found 22.2% grant Bash(rm:*) (4,101 users), 21.3% grant curl, 19.7% grant unchecked git push, and only 1.1% define any deny rule at all [5]. The human-in-the-loop is, empirically, a rubber stamp.
Documented vs. theoretical
| Vector | Status | Hardest evidence | Blast radius if it lands |
|---|---|---|---|
Agent runs destructive git |
Observed repeatedly, real victims | Unprompted git reset --hard origin/main at session startup on two consecutive days; 12 unpushed commits + uncommitted work permanently lost [2]. git checkout <file> ate 4 days of work [3] |
Uncommitted + unpushed work in the repo. Recoverable only via reflog, and only for committed objects |
| Supply-chain malware weaponizing the installed CLI | Observed, ~1,000+ victims | s1ngularity invoked claude --dangerously-skip-permissions -p <prompt>, gemini --yolo, q chat --trust-all-tools to hunt id_rsa, .env, wallet keystores [6] |
Every credential the agent can read → downstream GitHub/npm/cloud. Phase 2 made 6,700+ private repos public [6] |
| Malicious dependency pulled by a build the agent runs | Observed, industrial scale | Shai-Hulud 2.0 backdoored 796 npm packages (20M weekly downloads), ran TruffleHog locally, installed a self-hosted GitHub runner, and deleted the home directory when exfil failed [7]. 2026 waves: 639 malicious versions across 323 packages in ~1 hour [8] | Full user account. preinstall runs before any agent guardrail is consulted [8] |
| Indirect injection → credential exfil from Claude Code | Proven end-to-end, PoC-led | CVE-2025-55284: injected file content made Claude grep .env and encode it into a ping subdomain — ping/nslookup/dig/host were default-allowlisted (CVSS 7.1, fixed v1.0.4) [12] |
Any secret readable in the working tree or env |
| Injection via GitHub issue / PR content | Observed vector, real CVE | CVE-2025-66032 (CVSS 8.7): PR titles interpolated into the prompt unsanitised; malicious issue bodies got Claude to read /proc/self/environ [16] |
CI secrets, repo write access |
| Untrusted-repo cold start | Observed, multiple CVEs | CVE-2025-59536: .mcp.json in an untrusted directory executed shell commands at tool init; CVE-2026-21852: API keys leaked via a repo-set ANTHROPIC_BASE_URL before the trust prompt rendered [15] |
RCE / API key on first cd + claude |
| Third-party MCP server backdoor | Observed once, in the wild | postmark-mcp@1.0.16 added one BCC line to send_email, silently forwarding every agent-sent email to phan@giftshop.club — first tracked malicious MCP server [19] |
Everything that MCP server touches, invisibly |
| MCP config rewrite for persistent token theft | PoC (Mitiga, 11 May 2026) | npm postinstall rewrites MCP URLs in ~/.claude.json to proxy OAuth exchanges; survives token rotation, and “OAuth sessions may still appear legitimate in SaaS audit logs” [18] |
Persistent access to every connected SaaS |
| Sandbox escape (writes) | Proven, patched | CVE-2026-39861 (CVSS 7.7, fixed 2.1.64): sandboxed process creates a symlink out of the workspace, later unsandboxed write follows it → ~/.bashrc, cron [14] |
Host persistence from inside the sandbox |
| Sandbox escape (egress) | Proven, silently patched | SOCKS5 hostname null-byte parser differential: attacker.com\x00.google.com passes endsWith(), resolves to attacker.com. Vulnerable v2.0.24 → v2.1.89 (~130 releases, 5.5 months), fixed v2.1.90 with no changelog note [13] |
Egress allowlist is not a control you can rely on alone |
| Deny-rule bypass by padding | Proven, unpatched publicly (Apr 2026) | Hard cap of 50 security subcommands in bashPermissions.ts: 50 no-ops + a denied curl downgrades deny → “ask” [23] — and users approve 93% of asks [1] |
Deny lists are advisory |
| Slopsquatting / HalluSquatting | Registered names + agent install attempts observed; no live malware yet | 43% of hallucinated names recur across all 10 identical runs; react-codeshift spread to 237 repos via AI-generated skill files with daily agent install attempts [26]. Academic PoC used “harmless placeholders, not real malware” [25] |
Same as any malicious dep, but you invited it |
| Model misalignment / agent pursuing its own goal | Not observed | Anthropic lists it and explicitly notes it is not seen in practice [1] | — |
Ranked by likelihood × blast radius
| # | Risk | Likelihood | Blast radius | Why it ranks here |
|---|---|---|---|---|
| 1 | Malicious dependency executed by a build the agent runs | High — continuous, weekly npm waves through 2026 [8] | Whole user account, incl. ~ deletion [7] |
You don’t need to be targeted; preinstall fires before any agent permission check |
| 2 | Agent destroys uncommitted/unpushed work | High — recurring, reproducible issues, closed as not planned [2] [4] | Hours-to-days of local work, unrecoverable | The most-realized harm, and it’s not an attack — it’s category 1/2 of Anthropic’s model [1] |
| 3 | Credential exfil (SSH key, cloud creds, tokens) via injection or a poisoned config | Medium — proven chains, PoC-heavy, one mass campaign already used AI CLIs for exactly this [6] [17] | Beyond the machine: git remotes → CI → prod | apiKeyHelper in a written .claude/settings.json reads ~/.ssh/id_rsa on next start [17] |
| 4 | Injection via content the agent fetches (web page, README, issue) | Medium-high exposure, low observed hit rate on solo workstations. Google measured a 32% relative rise in malicious IPI content Nov 2025→Feb 2026 across 2-3B pages/month [11] | Whatever the trifecta allows — usually secrets out | Adaptive attacks exceed 85% success against coding assistants; all 12 tested defenses bypassed at >78% [22] |
| 5 | Third-party MCP server (malicious or just sloppy) | Medium | Everything in that server’s scope, silently | 34% of 2,614 MCP implementations command-injectable; 82% use path-traversal-prone FS ops [20] — ⚠ see calibration below |
| 6 | Untrusted-repo cold start | Medium — one cd into a cloned repo |
RCE or key leak before you see a prompt [15] | Repeat offender class: three separate CVEs on the same “trust prompt is too late” theme |
| 7 | Agent reaches a live production system through a stray token | Low on a dev workstation, catastrophic when it happens | Total, with backups | PocketOS: agent found a Railway token in an unrelated file, called volumeDelete, wiped prod and volume-level backups in 9 seconds; newest usable backup was 3 months old [24] |
| 8 | Data leaving via the agent’s legitimate channel | Certain, by design | Source code you didn’t intend to share | See below — this is a policy problem, not a breach |
| 9 | Malicious installer / fake “leaked Claude Code” | Low-medium, but active campaigns | Full infostealer (Vidar, GhostSocks, MacSync) | “Both campaigns exploit the pre-execution install phase, bypassing all Claude Code built-in controls entirely” [27] |
The legitimate egress channel
Worth separating from attacks, because containment can’t fix it — only configuration can. Per Anthropic’s docs: prompts, model outputs, and every file Claude reads in full go over TLS to the API; metrics never include code, prompts, or file paths (DISABLE_TELEMETRY=1); /feedback, /bug and /share do send conversation history including code, optionally opening a public GitHub issue (DISABLE_FEEDBACK_COMMAND=1); WebFetch sends the target hostname to api.anthropic.com for a blocklist check regardless of provider, and this is not covered by CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC [10].
The local half matters more for blast radius: session transcripts are cached in plaintext under ~/.claude/projects/ for 30 days by default [10]. Any infostealer that reads that directory gets a replay of every file the agent touched, including secrets it printed — which is exactly why the credential-stealer families target agent config paths. On consumer Free/Pro/Max accounts with the training toggle on, retention is 5 years [10].
Calibration: what’s overstated
- MCP vulnerability percentages are soft. A hands-on audit of 33 local MCP servers (433 tools) found a ~78% false-positive rate in pattern-based MCP scanners — only 6 of 27 flagged detections were genuine, and all 8 “prompt injection” hits were false [21]. Treat the 34%/82%/36.7% figures [20] as upper bounds on attack surface, not on exploitability.
- Claude Code is the least-bad of its peers, not safe. The 2026 systematic analysis rates Claude Code Low, Codex CLI and Copilot High, Cursor Critical [22]. Both catastrophic agent-deletes-prod stories in the public record involved Cursor-based agents, not the CLI [24].
- Guardrails degrade the attacker, they don’t stop them. In s1ngularity, ~50% of victims had an AI CLI installed, roughly 25% of Claude invocations were refused outright, and the AI path succeeded in under 25% of cases — but the campaign still netted 2,000+ verified secrets [6].
- “AI-orchestrated attack” headlines are about Claude Code as a weapon, not as your risk surface. GTG-1002 (Nov 2025) was a state actor jailbreaking Claude Code to attack ~30 organisations with 80-90% of tactical work automated [28]. Relevant to how fast an attacker moves after they get your keys; not a workstation threat in itself.
What containment must actually stop
Derived from the ranking, in priority order. Each of these is a sibling angle’s problem to solve — this angle only specifies the requirement.
- Writes outside the working tree must be structurally impossible, including via symlink [14] — this is what protects
~/.bashrc, cron, and the agent’s own.claude/settings.json[17]. - Uncommitted work must survive the agent, because
git reset --hardwill happen and Anthropic has closed those reports as not planned [2] [3]. - Long-lived credentials must not be readable from the agent’s process —
~/.ssh/id_rsa,~/.aws/credentials, git remotes’ push tokens, and any stray API token in an unrelated file [17] [24]. - Egress must be enforced below the agent (kernel/network layer), because in-process allowlists have been bypassed twice by outside researchers on first look [13] and deny rules can be padded out of existence [23]. DNS counts as egress [12].
npm install/ build steps need the same boundary as the agent, since the dependency, not the model, is the highest-likelihood attacker [7] [8].- Third-party MCP servers deserve dependency-grade review, and their config file (
~/.claude.json) deserves integrity monitoring [18] [19].
Out of scope here and covered by sibling angles: Claude Code’s own permission/sandbox features, Linux-native sandboxing primitives (bubblewrap, namespaces, systemd), container isolation, Proxmox VM/LXC separation, credential-isolation patterns, and audit/recovery tooling.