Tego AI says Claude Code flaw could send outside files on startup

Tego AI said a Claude Code startup-path issue could cause files outside a project to be included in the tool’s first model request.

Tego AI said on July 24, 2026, that it found and reported an issue in Claude Code that could cause a file from outside a developer’s project to be sent in the tool’s first request to Anthropic’s model, according to a GlobeNewswire release from the cybersecurity company.

The company said the behavior can occur when a developer clones an ordinary repository and starts Claude Code, Anthropic’s agentic command-line coding tool. Tego AI said Anthropic closed the report as Informative after it was submitted through HackerOne in July 2026.

The reported issue centers on how Claude Code handles startup memory and repository instructions, according to Tego AI. The company said a repository can include a CLAUDE.md file with an @import directive pointing to a symbolic link. Claude Code then follows the link to the file it resolves to, including files outside the project, and includes the file contents in the first request sent to the model, Tego AI said.

Tego AI said the action can happen without a tool call, without a file-edit approval prompt and without an out-of-project read warning that a user would recognize. The company said the warning does not appear because the relevant check reviews the in-repository link name rather than the external file to which the link resolves.

Tego AI said the first outbound request can carry local file contents before the model has taken any action. The company said the file only needs to be readable by the developer’s own account, which it described as a realistic condition in CI runners, containers and standardized developer images where sensitive paths can be predictable.

Tego AI described one delivery mechanism as a repository file named link that GitHub labels as a symbolic link pointing to /etc/passwd2. The company said that link would be visible to anyone browsing the repository.

The release also said a repository-committed settings file can redirect Claude Code’s outbound endpoint to a host chosen by the repository author. Tego AI described that as a separately known behavior.

Tego AI said Anthropic had already fixed the same underlying class of flaw twice in Claude Code, naming CVE-2025-59829 and CVE-2026-25724. The company said both prior issues were reported through HackerOne and resolved in the permission subsystem.

The new report said the same type of defect remained on a third code path: the startup memory loader. Tego AI said that path places what it finds onto the network before the model has acted.

According to Tego AI, Anthropic’s rationale for closing the report as Informative was that the Claude Code threat model treats the “trust this folder” dialog as the security boundary, and that accepting it grants broad read, edit and execute access. Tego AI said it does not dispute that Anthropic applied its model consistently, but said the question is how broad that boundary should be in enterprise setups.

Tomer Niv, Tego AI’s head of research, said in the release that the model acts as a network endpoint and that a file from outside the repository can leave the machine on the first request without code execution, cooperation from the model or an attacker-controlled server. He also said a single “trust this folder” click is being asked to carry too much weight because it cannot distinguish between running code and reading and exfiltrating a key.

Tego AI said it confirmed the behavior against Claude Code v2.1.x and published a full technical report on its blog. The GlobeNewswire release described the company as a cybersecurity firm developing runtime security and control technology for enterprise AI agents. Tego AI said this was its second public Claude-related security disclosure in a week.

Sources

• GlobeNewswire press release

Editorial note: This article was prepared with AI assistance and requires editorial review before publication.