📄 Description (English)
Claude Code is an agentic coding tool. Prior to version 2.0.65, vulnerability in Claude Code's project-load flow allowed malicious repositories to exfiltrate data including Anthropic API keys before users confirmed trust. An attacker-controlled repository could include a settings file that sets ANTHROPIC_BASE_URL to an attacker-controlled endpoint and when the repository was opened, Claude Code would read the configuration and immediately issue API requests before showing the trust prompt, potentially leaking the user's API keys. Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to version 2.0.65, which contains a patch, or to the latest version.
🤖 AI Executive Summary
Claude Code versions prior to 2.0.65 contain a critical credential exposure vulnerability where malicious repositories can exfiltrate Anthropic API keys before users confirm trust. The vulnerability exploits the project-load flow by manipulating configuration files to redirect API requests to attacker-controlled endpoints. This poses significant risk to Saudi organizations using Claude Code for development, particularly those integrating AI-assisted coding into their software development pipelines.
📄 Description (Arabic)
🤖 AI Intelligence Analysis Analyzed: May 3, 2026 19:27
🇸🇦 Saudi Arabia Impact Assessment
Saudi financial institutions (SAMA-regulated banks) and government agencies (NCA oversight) using Claude Code for development face direct risk of API credential compromise, potentially leading to unauthorized access to AI services and data exfiltration. Technology companies, telecommunications providers (STC, Mobily), and energy sector organizations (ARAMCO subsidiaries) developing software with Claude Code integration are at elevated risk. The vulnerability could enable supply chain attacks targeting Saudi software development practices, particularly affecting organizations adopting AI-assisted development tools without proper security controls.
🏢 Affected Saudi Sectors
Banking and Financial Services
Government and Public Administration
Technology and Software Development
Telecommunications
Energy and Utilities
Healthcare
Education and Research
🎯 MITRE ATT&CK Techniques
T1555 - Credentials from Password Stores (API key extraction)
T1187 - Forced Authentication (malicious repository trust exploitation)
T1040 - Traffic Redirection (ANTHROPIC_BASE_URL manipulation)
T1041 - Exfiltration Over C2 Channel (API key exfiltration)
T1105 - Ingress Tool Transfer (malicious configuration delivery)
T1036 - Masquerading (legitimate repository appearing malicious)
T1199 - Trusted Relationship (supply chain attack via repository)
⚖️ Saudi Risk Score (AI)
8.2
/ 10.0
🔧 Remediation Steps (English)
IMMEDIATE ACTIONS:
1. Audit all Claude Code installations across development teams to identify versions prior to 2.0.65
2. Revoke all Anthropic API keys that may have been exposed or used with vulnerable Claude Code versions
3. Disable Claude Code auto-update if not already enabled and perform manual controlled updates
4. Review repository access logs for suspicious configuration file modifications
PATCHING GUIDANCE:
1. Update Claude Code to version 2.0.65 or latest immediately across all development environments
2. For organizations with auto-update enabled, verify update completion by checking version numbers
3. Implement mandatory update policies for development tools with security implications
COMPENSATING CONTROLS:
1. Implement network-level monitoring to detect API requests to unauthorized ANTHROPIC_BASE_URL endpoints
2. Use API key rotation policies with 30-day maximum key lifetime
3. Implement repository access controls requiring code review before opening untrusted repositories
4. Deploy endpoint detection and response (EDR) solutions to monitor for suspicious API key access patterns
5. Restrict Claude Code usage to approved, internally-vetted repositories only
DETECTION RULES:
1. Monitor for ANTHROPIC_BASE_URL configuration changes in .claude or settings files
2. Alert on API requests from Claude Code to non-standard Anthropic endpoints
3. Track API key usage patterns for anomalous authentication attempts
4. Monitor file system access to credential storage locations during repository load operations
🔧 خطوات المعالجة (العربية)
الإجراءات الفورية:
1. تدقيق جميع تثبيتات Claude Code عبر فرق التطوير لتحديد الإصدارات السابقة للإصدار 2.0.65
2. إلغاء جميع مفاتيح Anthropic API التي قد تكون تعرضت للخطر أو تم استخدامها مع إصدارات Claude Code الضعيفة
3. تعطيل تحديث Claude Code التلقائي إن لم يكن مفعلاً بالفعل وإجراء تحديثات يدوية محكومة
4. مراجعة سجلات الوصول إلى المستودع للتعديلات المريبة على ملفات التكوين
إرشادات التصحيح:
1. تحديث Claude Code إلى الإصدار 2.0.65 أو الأحدث فوراً عبر جميع بيئات التطوير
2. للمنظمات التي تم تفعيل التحديث التلقائي فيها، تحقق من اكتمال التحديث بفحص أرقام الإصدارات
3. تنفيذ سياسات التحديث الإلزامية لأدوات التطوير ذات الآثار الأمنية
الضوابط البديلة:
1. تنفيذ المراقبة على مستوى الشبكة للكشف عن طلبات API إلى نقاط نهاية ANTHROPIC_BASE_URL غير المصرح بها
2. استخدام سياسات تدوير مفاتيح API مع حد أقصى لعمر المفتاح 30 يوماً
3. تنفيذ ضوابط الوصول إلى المستودع تتطلب مراجعة الكود قبل فتح المستودعات غير الموثوقة
4. نشر حلول الكشف والاستجابة على نقطة النهاية (EDR) لمراقبة أنماط الوصول المريبة لمفاتيح API
5. تقييد استخدام Claude Code إلى المستودعات المعتمدة والمدققة داخلياً فقط
قواعد الكشف:
1. مراقبة تغييرات تكوين ANTHROPIC_BASE_URL في ملفات .claude أو الإعدادات
2. تنبيهات على طلبات API من Claude Code إلى نقاط نهاية Anthropic غير القياسية
3. تتبع أنماط استخدام مفاتيح API للمحاولات المصادقة الشاذة
4. مراقبة الوصول إلى نظام الملفات لمواقع تخزين بيانات الاعتماد أثناء عمليات تحميل المستودع
📋 Regulatory Compliance Mapping
🟢 NCA ECC 2024
ECC 2024 A.5.1.1 - Access Control Policies (API key management)
ECC 2024 A.8.2.1 - User Authentication (credential protection)
ECC 2024 A.8.2.3 - Password Management (API key rotation)
ECC 2024 A.12.2.1 - Change Management (software updates)
ECC 2024 A.12.4.1 - Event Logging (API request monitoring)
🔵 SAMA CSF
SAMA CSF ID.AM-2 - Asset Management (software inventory)
SAMA CSF PR.AC-1 - Access Control (credential management)
SAMA CSF PR.AC-2 - Physical and Logical Access (API key protection)
SAMA CSF DE.CM-1 - Detection and Analysis (anomalous API usage)
SAMA CSF RS.MI-2 - Incident Response (credential compromise)
🟡 ISO 27001:2022
ISO 27001:2022 A.5.15 - Supplier Relationships (third-party tool security)
ISO 27001:2022 A.8.2.1 - User Registration and Access Rights (API key management)
ISO 27001:2022 A.8.2.3 - Management of Privileged Access Rights (credential protection)
ISO 27001:2022 A.8.3.2 - Password Management (API key rotation)
ISO 27001:2022 A.12.2.1 - Change Management (software patching)
ISO 27001:2022 A.12.4.1 - Event Logging (API request monitoring)
📦 Affected Products / CPE 1 entries
anthropic:claude_code