{"id":17052,"date":"2026-07-24T23:02:48","date_gmt":"2026-07-24T23:02:48","guid":{"rendered":"https:\/\/techtrendfeed.com\/?p=17052"},"modified":"2026-07-24T23:02:48","modified_gmt":"2026-07-24T23:02:48","slug":"hidden-hyperlink-silently-sends-recordsdata-to-attackers","status":"publish","type":"post","link":"https:\/\/techtrendfeed.com\/?p=17052","title":{"rendered":"Hidden Hyperlink Silently Sends Recordsdata to Attackers"},"content":{"rendered":"<p> <br \/>\n<\/p>\n<div>\n<style><![CDATA[\n#ar-widget{margin:0 0 2rem;font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",sans-serif;}\n#ar-widget .ar-box{background:#fff;border:1px solid #e5e7eb;border-radius:12px;padding:1.1rem 1.4rem;}\n#ar-widget .ar-top{display:flex;align-items:center;gap:10px;margin-bottom:.85rem;}\n#ar-widget .ar-icon-wrap{width:38px;height:38px;border-radius:50%;background:#EEEDFE;display:flex;align-items:center;justify-content:center;flex-shrink:0;}\n#ar-widget .ar-meta{flex:1;min-width:0;}\n#ar-widget .ar-label{font-size:10px;color:#9ca3af;text-transform:uppercase;letter-spacing:.06em;margin:0 0 2px;}\n#ar-widget .ar-title-text{font-size:13px;font-weight:600;margin:0;color:#111827;white-space:nowrap;overflow:hidden;text-overflow:ellipsis;}\n#ar-widget .ar-progress-section{margin-bottom:.7rem;}\n#ar-widget #ar-seek{width:100%;height:4px;accent-color:#534AB7;cursor:pointer;display:block;margin:0;-webkit-appearance:none;appearance:none;background:#e5e7eb;border-radius:2px;outline:none;border:none;}\n#ar-widget #ar-seek::-webkit-slider-thumb{-webkit-appearance:none;width:14px;height:14px;border-radius:50%;background:#534AB7;cursor:pointer;}\n#ar-widget .ar-times{display:flex;justify-content:space-between;font-size:10px;color:#9ca3af;margin-top:3px;}\n#ar-widget .ar-controls{display:flex;align-items:center;gap:7px;flex-wrap:wrap;}\n#ar-widget .ar-controls button{border:1px solid #d1d5db;border-radius:8px;padding:5px 11px;background:#fff;cursor:pointer;font-size:12px;color:#374151;}\n#ar-widget .ar-controls button:hover{background:#f9fafb;}\n#ar-widget .ar-play-btn{border-color:#534AB7!important;color:#534AB7!important;font-weight:600;min-width:86px;text-align:center;}\n#ar-widget .ar-play-btn:hover{background:#EEEDFE!important;}\n#ar-widget .ar-speed-wrap{margin-left:auto;display:flex;align-items:center;gap:5px;}\n#ar-widget .ar-speed-wrap label{font-size:11px;color:#6b7280;}\n#ar-widget #ar-rate{border:1px solid #d1d5db;border-radius:6px;padding:3px 5px;font-size:11px;background:#fff;color:#374151;cursor:pointer;}\n#ar-widget #ar-status{font-size:11px;color:#9ca3af;margin:.65rem 0 0;padding-top:.65rem;border-top:1px solid #f3f4f6;}\n#ar-widget .ar-voice-row{display:flex;align-items:center;gap:6px;margin-top:8px;}\n#ar-widget .ar-voice-row label{font-size:11px;color:#6b7280;flex-shrink:0;}\n#ar-widget #ar-voice{flex:1;min-width:0;border:1px solid #d1d5db;border-radius:6px;padding:4px 6px;font-size:11px;background:#fff;color:#374151;cursor:pointer;}\n]]><\/style>\n<p class=\"sc-lpcdUm dHRSsU\"><span><strong>Tel Aviv, Israel, July twenty fourth, 2026, CyberNewswire<\/strong><\/span><\/p>\n<p>One week after disclosing that Anthropic\u2019s <a rel=\"nofollow\" target=\"_blank\" target=\"_blank\" rel=\"nofollow noopener\" href=\"https:\/\/tego.ai\/blog\/tego-ai-finds-anthropics-claude-tag-slack-integration-can-trigger-unauthorized-enterprise-actions\">Claude Tag Slack integration might be pushed by plain \u201c@Claude\u201d textual content,<\/a> Tego AI in the present day printed a second piece of analysis on the Claude ecosystem. This one focuses on <strong>Claude Code<\/strong>, Anthropic\u2019s agentic command-line coding instrument.<\/p>\n<p>Cloning an bizarre repository and beginning Claude Code may cause the instrument to learn a file from outdoors the challenge and embody it within the mannequin\u2019s first request, with out a warning or approval immediate the consumer would acknowledge.<\/p>\n<p>The approach is bizarre, and that&#8217;s a part of why it issues. A repository can commit a normal-looking instruction file, <i>CLAUDE.md<\/i>, whose <i>@import<\/i> directive factors to a symbolic hyperlink. When a developer clones the repository and begins Claude Code, the instrument follows the hyperlink to no matter file it resolves to, together with recordsdata nicely outdoors the challenge, and folds that file\u2019s contents into the primary request it sends to the mannequin.<\/p>\n<p>No instrument name fires, and no file-edit approval seems. The dialog Claude Code makes use of to catch out-of-project reads doesn&#8217;t seem both, as a result of it checks the in-repository hyperlink identify, corresponding to <i>.\/hyperlink<\/i>, quite than the exterior file the hyperlink resolves to.<\/p>\n<p>The entire supply mechanism is a repository file named <i>hyperlink<\/i> that GitHub itself labels as a symbolic hyperlink pointing to <i>\/and so forth\/passwd2<\/i>, seen to anybody searching the repository.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/hackread.com\/wp-content\/uploads\/2026\/07\/imageedit_15_9111475967_17848872246HIx9XnzQ2.jpg\"\/><\/p>\n<blockquote>\n<p>\u201cContext is no matter will get despatched to the mannequin, and the mannequin is a community endpoint like some other,\u201d stated <strong>Tomer Niv, Head of Analysis at Tego AI<\/strong>. \u201cSo this isn&#8217;t a file that quietly sits in a immediate. Clone a repo, reply the identical \u2018belief this folder?\u2019 query you at all times reply, and a file from outdoors that repo can depart your machine on the primary request, with no code execution, no cooperation from the mannequin, and no server the attacker has to run.\u201d<\/p>\n<\/blockquote>\n<p>The result&#8217;s that the out-of-project file\u2019s contents seem contained in the request physique Claude Code sends when the session begins. The info leaves the native machine as a part of the outbound request, quite than remaining solely in native mannequin context.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/hackread.com\/wp-content\/uploads\/2026\/07\/imageedit_17_7122930868_1784887256z9DlmwCISN.jpg\"\/><\/p>\n<p class=\"chainwire-video-container\">\n<div class=\"jeg_video_container jeg_video_content\"><iframe loading=\"lazy\" title=\"Hidden Repo Links Can Make Claude Code Silently Send Files to Attackers\" width=\"500\" height=\"281\" src=\"https:\/\/www.youtube.com\/embed\/Et0hZI34NUM?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe><\/div>\n<p>Anthropic has already fastened this underlying class of flaw twice. What makes the brand new report notable is the place the flaw sits, not that the sample is new.<\/p>\n<p>The identical failure, a safety test studying one path whereas the filesystem follows a symbolic hyperlink to a different, beforehand appeared in Claude Code and was fastened accurately in CVE-2025-59829 and CVE-2026-25724. Each have been reported via HackerOne and resolved within the permission subsystem.<\/p>\n<p>Tego AI\u2019s analysis exhibits that the identical defect remained current on a 3rd code path, the startup reminiscence loader, which these fixes by no means reached. That path can be the one which locations what it finds onto the community earlier than the mannequin has taken any motion.<\/p>\n<p>The technical write-up additionally paperwork {that a} repository-committed settings file can redirect Claude Code\u2019s outbound endpoint to a bunch chosen by the repository creator, a individually identified habits. The uncovered file solely must be readable by the developer\u2019s personal account. That could be a practical situation in CI runners, containers, and standardized developer photos, the place delicate file paths are sometimes predictable.<\/p>\n<p>Tego AI\u2019s level is about that safety boundary quite than a single bug. The corporate reported the difficulty to Anthropic via HackerOne in July 2026, and Anthropic closed it as Informative.<\/p>\n<p>Anthropic\u2019s rationale was constant and clearly said: beneath the Claude Code risk mannequin, the \u201cbelief this folder\u201d dialog is the safety boundary, and accepting it already grants a challenge broad learn, edit, and execute entry. Tego AI doesn&#8217;t dispute that Anthropic utilized its said mannequin constantly.<\/p>\n<blockquote>\n<p>\u201cWe perceive the mannequin. Our disclosure is an argument about its phrases,\u201d Niv stated. \u201cA single \u2018belief this folder\u2019 click on is being requested to hold an unlimited quantity of weight, at least knowledgeable second doable, earlier than you may have seen something the repository does. It can&#8217;t inform the distinction between \u2018run my code\u2019 and \u2018learn my SSH key and mail it out,\u2019 and in lots of actual setups that click on was inherited from a mother or father listing and by no means truly proven for the repository in query. As enterprises undertake AI coding brokers, that&#8217;s precisely the boundary they want to have the ability to motive about.\u201d<\/p>\n<\/blockquote>\n<p>The disclosure continues a theme in Tego AI\u2019s analysis: for enterprise AI brokers, the unresolved query is authorization, that means who, or what, is allowed to instruct the agent and attain its knowledge and related programs. The Claude Tag analysis raised that query about an inbound Slack message. This analysis raises it about an bizarre Git clone.<\/p>\n<p>Tego AI notes that symbolic-link assaults are many years outdated and that Anthropic has repeatedly hardened Claude Code towards them in good religion. The corporate printed the write-up so customers and safety groups can motive precisely about what \u201cbelief this folder\u201d grants in apply.<\/p>\n<p>Tego AI confirmed the habits towards Claude Code v2.1.x.<\/p>\n<p>The total technical report is offered at: <a rel=\"nofollow\" target=\"_blank\" target=\"_blank\" rel=\"nofollow noopener\" href=\"https:\/\/tego.ai\/blog\/a-hidden-project-link-can-make-claude-code-silently-send-your-files-to-an-attacker\">https:\/\/tego.ai\/weblog\/a-hidden-project-link-can-make-claude-code-silently-send-your-files-to-an-attacker<\/a><\/p>\n<p><strong>About Tego AI<\/strong><\/p>\n<p>Tego AI is a cybersecurity firm growing runtime safety and management expertise for enterprise AI brokers. Its platform helps organizations monitor agent exercise and cease unauthorized or dangerous actions earlier than brokers entry delicate knowledge or related programs.<\/p>\n<p>The corporate operates in stealth. That is its second public safety disclosure in every week. In keeping with Tego AI, there&#8217;s extra to come back.<\/p>\n<h5 id=\"contact\">Contact<\/h5>\n<p><span><strong>CTO<\/strong><br \/><\/span><span><strong>Tal Melamed<\/strong><br \/><\/span><span><strong>Tego AI<\/strong><br \/><\/span><span><strong><a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/hackread.com\/cdn-cgi\/l\/email-protection\" class=\"__cf_email__\" data-cfemail=\"e296838ea29687858dcc838b\">[email\u00a0protected]<\/a><\/strong><br \/><\/span><\/p>\n<p>\n\t\t\t<\/div>\n<p><template id="VTnZiSQ81PtGa2B4tf7n"></template><\/script><br \/>\n<br \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Tel Aviv, Israel, July twenty fourth, 2026, CyberNewswire One week after disclosing that Anthropic\u2019s Claude Tag Slack integration might be pushed by plain \u201c@Claude\u201d textual content, Tego AI in the present day printed a second piece of analysis on the Claude ecosystem. This one focuses on Claude Code, Anthropic\u2019s agentic command-line coding instrument. Cloning an [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":17054,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[58],"tags":[1629,129,762,1284,3718,9911],"class_list":["post-17052","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-attackers","tag-files","tag-hidden","tag-link","tag-sends","tag-silently"],"_links":{"self":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/17052","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=17052"}],"version-history":[{"count":1,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/17052\/revisions"}],"predecessor-version":[{"id":17053,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/17052\/revisions\/17053"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/media\/17054"}],"wp:attachment":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17052"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17052"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17052"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}<!-- This website is optimized by Airlift. Learn more: https://airlift.net. Template:. Learn more: https://airlift.net. Template: 69d9690a190636c2e0989534. Config Timestamp: 2026-04-10 21:18:02 UTC, Cached Timestamp: 2026-07-25 22:30:04 UTC -->