{"id":"TECH-202611-sfuqeq","kind":"technique","aliases":[],"related":[],"title":"Claude Code VS Code extension's permission prompt hides where a symlink really points, so you can approve file access outside the project without knowing (UltraStrike, Anthropic won't fix)","description":null,"summary":"UltraStrike (Carl Pearson, 2026-11-11) found that Anthropic's Claude Code extension for VS Code (anthropic.claude-code) asks for approval when the agent reads or writes through a symlink that leads outside the workspace, but the prompt shows only the in-workspace path (e.g. ./helpdocs/test.txt), not the real target. A user who approves may be letting the agent read or write files elsewhere, such as SSH keys in ~/.ssh. An agent under prompt injection, or a malicious symlink pushed to a shared repo by a compromised teammate account, can use this. The Claude Code CLI shows the real target and warns, after a silent fix following Adversa AI's May 2026 report; the VS Code extension does not. Reported to Anthropic on 2026-10-22; Anthropic closed it as not a vulnerability. Still unpatched in extension 2.1.322. Proof of concept only; no attacks reported. No CVE.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Claude Code for VS Code","note":"no fix; Anthropic declined","fixed":[],"affected":"<= 2.1.322","ecosystem":"vscode"}],"ecosystems":[],"tags":["early-warning","technique"],"not_affected_if":[],"how_to_check":"- Find developers using the Claude Code extension for VS Code (anthropic.claude-code); 2.1.322 is confirmed affected, no fixed version.\n- Look for symlinks in repos that point outside the repo: find . -type l -exec realpath {} \\; and compare against the workspace path.\n- Watch for new or renamed symlinks arriving in repo syncs or commits.","fix":"- Before approving a file permission prompt in the VS Code extension, run realpath <path shown in the prompt> in a terminal and deny if it resolves outside the workspace.\n- Prefer the Claude Code CLI, which shows the real symlink target and warns.\n- Review commits that add symlinks in shared repos; open untrusted repos in a container or VM without SSH keys or cloud credentials.","status":"open","published_at":null,"first_seen_at":"2026-11-15T13:06:43+00:00","triaged_at":"2026-11-15T13:06:43+00:00","updated_at":"2026-11-15T13:06:55+00:00","category":"ai-tooling","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-10':168B '-11':47B,48B '-202611':32A '-22':169B '/.ssh':113B '/helpdocs/test.txt':89B '2.1.322':181B '2026':46B,155B,167B 'access':20A 'account':132B 'adversa':151B 'agent':66B,102B,115B 'ai':152B 'anthrop':27A,51B,165B,170B 'anthropic.claude':59B 'approv':18A,63B,97B 'ask':61B 'attack':187B 'carl':44B 'claud':1A,53B,137B 'claude':34A 'cli':139B 'close':171B 'code':2A,4A,35A,38A,54B,58B,60B,138B,159B 'compromis':130B 'concept':184B 'cve':190B 'e.g':88B 'earli':40B 'early-warn':39B 'elsewher':107B 'extens':5A,55B,160B,180B 'file':19A,106B 'fix':30A,149B 'follow':150B 'for':36A 'found':49B 'hide':9A 'in-workspac':84B 'inject':118B 'key':111B 'know':25A 'lead':74B 'let':100B 'malici':121B 'may':98B,154B 'outsid':21A,75B 'path':87B 'pearson':45B 'permiss':7A 'point':14A 'project':23A 'prompt':8A,80B,117B 'proof':182B 'push':123B 'read':67B,103B 'real':92B,142B 'realli':13A 'repo':127B 'report':156B,163B,188B 'sfuqeq':33A 'share':126B 'show':81B,140B 'silent':148B 'ssh':110B 'still':177B 'symlink':12A,72B,122B 'target':93B,143B 'teammat':131B 'tech':31A 'techniqu':42B 'ultrastrik':26A,43B 'unpatch':178B 'use':134B 'user':95B 'vs':3A,37A,57B,158B 'vulner':176B 'warn':41B,145B 'without':24A 'won':28A 'workspac':77B,86B 'write':69B,105B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["claudecodeforvscode","codeforvscode"],"ptokens":["claude","code","for","vs"],"labels":["aitooling","earlywarning","medium","technique"],"campaign_type":"exploitation","search_a":"'-202611':32A 'access':20A 'anthrop':27A 'approv':18A 'claud':1A 'claude':34A 'code':2A,4A,35A,38A 'extens':5A 'file':19A 'fix':30A 'for':36A 'hide':9A 'know':25A 'outsid':21A 'permiss':7A 'point':14A 'project':23A 'prompt':8A 'realli':13A 'sfuqeq':33A 'symlink':12A 'tech':31A 'ultrastrik':26A 'vs':3A,37A 'without':24A 'won':28A","search_b":"'-10':168B '-11':47B,48B '-22':169B '/.ssh':113B '/helpdocs/test.txt':89B '2.1.322':181B '2026':46B,155B,167B 'account':132B 'adversa':151B 'agent':66B,102B,115B 'ai':152B 'anthrop':51B,165B,170B 'anthropic.claude':59B 'approv':63B,97B 'ask':61B 'attack':187B 'carl':44B 'claud':53B,137B 'cli':139B 'close':171B 'code':54B,58B,60B,138B,159B 'compromis':130B 'concept':184B 'cve':190B 'e.g':88B 'earli':40B 'early-warn':39B 'elsewher':107B 'extens':55B,160B,180B 'file':106B 'fix':149B 'follow':150B 'found':49B 'in-workspac':84B 'inject':118B 'key':111B 'lead':74B 'let':100B 'malici':121B 'may':98B,154B 'outsid':75B 'path':87B 'pearson':45B 'prompt':80B,117B 'proof':182B 'push':123B 'read':67B,103B 'real':92B,142B 'repo':127B 'report':156B,163B,188B 'share':126B 'show':81B,140B 'silent':148B 'ssh':110B 'still':177B 'symlink':72B,122B 'target':93B,143B 'teammat':131B 'techniqu':42B 'ultrastrik':43B 'unpatch':178B 'use':134B 'user':95B 'vs':57B,158B 'vulner':176B 'warn':41B,145B 'workspac':77B,86B 'write':69B,105B","search_c":"","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"TECH-202611-sfuqeq","url":"https://ultrastrike.io/2026/11/claude-code-vscode-plugin-workspace-escape-via-misleading-permission-prompt/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-15T13:06:43+00:00","fetched_at":"2026-11-15T13:06:43+00:00","note":null,"cites":["https://ultrastrike.io/2026/11/claude-code-vscode-plugin-workspace-escape-via-misleading-permission-prompt/"]}],"documents":[{"id":163229,"url":"https://x.com/_r_netsec/status/2121944244982292704","title":"@_r_netsec: Claude Code VSCode Plugin: Workspace Escape Via Misleading Permission Prompt htt","kind":"post","source":"x","publisher":null,"text":"Claude Code VSCode Plugin: Workspace Escape Via Misleading Permission Prompt https://t.co/mO6gXs7Kq5\n\nlikes 0 reposts 0","published_at":"2026-11-15T12:31:46+00:00","relation":"describes","confidence":null,"note":null},{"id":163383,"url":"https://ultrastrike.io/2026/11/claude-code-vscode-plugin-workspace-escape-via-misleading-permission-prompt/","title":"Claude Code VSCode Plugin: Workspace Escape Via Misleading Permission Prompt - UltraStrike Cybersecurity","kind":"blog","source":"analyst","publisher":null,"text":"UltraStrike (Carl Pearson, 2026-11-11): Anthropic's Claude Code VS Code extension (anthropic.claude-code) permission prompt shows workspace-relative symlink paths, not the real target outside the workspace, so users approve read/write outside the workspace (e.g. ~/.ssh). Builds on Adversa AI May 2026 CLI symlink finding, silently fixed in CLI. Reported via HackerOne 22 Oct 2026; Anthropic closed as informative. Unpatched in plugin 2.1.322. Workaround: realpath the path shown in the prompt.","published_at":"2026-11-11T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}