Critical Vulnerability in Claude Code Emerges Days After Source Leak

0:00Anthropics Cloud Code is in the news again, and not for the best reasons. Within days of each other, Anthropic first leaked the source code to Cloud Code, and then a critical vulnerability was found by Adversa AI. Cloud Code leak On March 31, 2026, Anthropic mistakenly included a debugging JavaScript source map for Cloud Code version 2.1.88 to NPM. Within hours, researcher Chaufe and show discovered the source map and posted a link on X, kicking off a global rush to examine deabfuscated Cloud Code's code. Sigrid Jean, a 25-year-old student at the University of British Columbia, worked with Yechan Hio to reconstruct the Cloud Code. It took two humans, ten open claws, a MacBook Pro laptop, and a few hours to recreate the popular AI agent's source code and share it with the world. Reports Yahoo, proving that what goes up on the internet does not come down off the internet.

1:00The result now persists on the internet, comprising 512,000 lines of TypeScript in 1900 files. It is awkward but not catastrophic for Anthropic. While the Cloud Code leak does present real risk, it is not the same as model weights, training data or customer data being compromised. What was exposed is something more like an operational blueprint of how the current version of Cloud Code is designed to work. Explains Melissa Bischoping, senior director of security and product design research at TANIUM. The key is that researchers can see how Cloud Code is meant to work but cannot recreate it because the leak does not include the Cloud model weights, the training data, customer data, APIs or credentials. It is not a foolproof roadmap to exploitation, but it is meaningful insight into how the tool handles inputs, enforces permissions and resists abuse. Continues Bischoping. Another layer of risk from this leak is that adversaries may

2:01use the blueprint to build lookalikes that appear and behave like Cloud Code on the surface, but install malware or harvest credentials and data. She adds, awkward and embarrassing for Anthropic, but not directly harmful to Cloud Code. Vulnerability in Cloud Code. But a genuine and critical vulnerability has now been discovered in Cloud Code proper by Adversa AI Red Team. Cloud Code is a 519-000-plus-line TypeScript application that allows developers to interact with Cloud directly from the command line. It can edit files, execute shell commands, search code bases, manage git workflows, and orchestrate complex multi-step development tasks. Reports at Versa. Never allow curl or git, prevent data exfiltration, but auto-allow and PM and git commands, common development tools. That sounds correct and reasonable. The flaw, however, is that the deny rules can be bypassed. The permission system is the primary security boundary between the AI

3:05agent and the developer's system. Reports at Versa. When it fails silently, the developer has no safety net. The problem stems from Anthropic's desire for improved performance following the discovery of a performance issue. Complex compound commands cause the UI to freeze. Anthropic fix this by capping analysis at 50 subcommands with a fall back to a generic ask prompt for anything else. The code comments states, 50 is generous. Legitimate user commands don't split that wide. Above the cap we fall back to ask, safe default. We can't prove safety, so we prompt. The flaw discovered by at Versa is that this process can be manipulated. Anthropic's assumption doesn't account for AI-generated commands from prompt injection, where a malicious claw.md file instructs the AI to generate a 50 plus subcommand pipeline that looks like a legitimate build process. If this is done, behavior asks forward slash forward slash not deny occurs

4:08immediately. Deny rules, security validators, command injection detection, all skipped. Rights of Versa. The 51st command reverts to ask is required, but the user gets no indication that all deny rules have been ignored. At Versa ones that a motivated attacker could embed real looking build steps in a malicious repository's claw.md. It would look routine, but no per subcommand analysis runs at all when the count exceeds 50. This could allow the attacker to exfiltrate SSH private keys, AWS credentials, GitHub tokens, and PM tokens or END secrets. It could lead to credential theft at scale, supply chain compromise, cloud infrastructure breach, and CI slash CD pipeline poisoning. During testing, Claude's LLM safety layer independently caught some obviously malicious payloads and refused to execute them. This is good defense and depth. Rights of Versa. However, the permission system vulnerability exists regardless of the LLM layer. It is a bug in

5:14the security policy enforcement code. A sufficiently crafted prompt injection that appears as legitimate build instructions could bypass the LLM layer two.