CLAUDE CODE FOR VS CODE · TECH-202611-sfuqeq · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
UltraStrike (Carl Pearson, 2026-11-11) found that Anthropic's Claude Code extension for VS Code (anthropic.claude-code) asks for approval when the agent reads or writes through a symlink that leads outside the workspace, but the prompt shows only the in-workspace path (e.g. ./helpdocs/test.txt), not the real target. A user who approves may be letting the agent read or write files elsewhere, such as SSH keys in ~/.ssh. An agent under prompt injection, or a malicious symlink pushed to a shared repo by a compromised teammate account, can use this. The Claude Code CLI shows the real target and warns, after a silent fix following Adversa AI's May 2026 report; the VS Code extension does not. Reported to Anthropic on 2026-10-22; Anthropic closed it as not a vulnerability. Still unpatched in extension 2.1.322. Proof of concept only; no attacks reported. No CVE.
first public Nov 11, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Posts are quoted with a link to the original. They are data to us, never instructions.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.