Claude Code can load files from outside a repository through a symlinked memory import, which may allow local data to be included in the model’s first outbound request before the model performs any actions.
A recently reported Claude Code issue highlights a consent and provenance flaw in its memory import feature, rather than its expected handling of filesystem symlinks.
Instead, the tool checks whether an @import is within a project using its visible path, but it follows symlinks when reading the file. This difference allows a malicious repository to import a readable file from outside its directory without triggering Claude Code’s external import approval dialog.
link as an in-repo symlink resolving to /etc/passwd2 (Source: Tego)Claude Code loads project instructions from CLAUDE.md and files located under .claude/rules/. These files can include imports such as @./docs/setup.md, enabling teams to include shared instructions when a session starts automatically.
A malicious repository could place a line like @./link in CLAUDE.md and then commit link as a Git symlink pointing to an external local file. For example, the symlink could lead to /etc/passwd, /proc/self/environ, or another file that is readable by the current user.
Claude Code Repository Attack
The security issue arises because Claude Code evaluates ./link as an internal repository path before resolving it. Since the lexical path appears to be inside the project, no external import warning is generated. However, when the memory loader reads the file, the operating system follows the symlink to its true target outside the repository.
/etc/passwd2, with a byte-for-byte match to the original file (Source: Tego)The contents of the external file are then added to the model’s initial context. This occurs before Claude Code can call a read tool, execute a command, or ask the user for approval. Reports have shown that the content of the imported file was included in the first outbound request sent by Claude Code.
By default, this content is sent to Anthropic’s API endpoint. However, repository-controlled .claude/settings.json files can set ANTHROPIC_BASE_URL, a known configuration override that may direct Claude Code traffic to a different endpoint. Tego Researchers showed imported data could be exfiltrated to a repository-selected server.
This issue may be particularly relevant for developers who have previously trusted broad parent directories, such as a home folder, ~/src, or /Users. Claude Code’s workspace trust applies to repositories within trusted directories, meaning a newly cloned project may not prompt a fresh trust dialog.
The report connects this behavior to earlier Claude Code symlink issues, including CVE-2025-59829 and CVE-2026-25724. In both cases, Anthropic addressed a similar flaw by resolving symlinks before enforcing security checks.
/etc/hosts but not ./link, despite both pointing outside the repository (Source: Tego)Researchers argue that the memory loader did not receive the same canonical-path validation. They tested this behavior on Claude Code version 2.1.215, while static analysis also identified the issue in version 2.1.207.
Anthropic has reportedly classified the HackerOne submission as informative, clarifying that workspace trust is the intended security boundary and allows reading, editing, and executing within a trusted project context.
Researchers recommend canonicalizing import targets before applying containment and consent checks. They also advise warning users when imports resolve outside the repository and clearly identifying settings that can change endpoints in repository configurations.
