---
id: "TECH-202611-sfuqeq"
page: "https://infrastack.ai/live/TECH-202611-sfuqeq"
kind: "technique"
aliases: []
title: "Claude Code VS Code extension's permission prompt hides where a symlink really points, so you can approve file access outside the project without knowing (UltraStrike, Anthropic won't fix)"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "Claude Code for VS Code", "note": "no fix; Anthropic declined", "fixed": [], "affected": "<= 2.1.322", "ecosystem": "vscode"}]
ecosystems: []
tags: ["early-warning", "technique"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-15T13:06:43+00:00"
updated_at: "2026-11-15T13:06:55+00:00"
sources: [{"source": "analyst", "url": "https://ultrastrike.io/2026/11/claude-code-vscode-plugin-workspace-escape-via-misleading-permission-prompt/", "first_seen_at": "2026-11-15T13:06:43+00:00", "cites": ["https://ultrastrike.io/2026/11/claude-code-vscode-plugin-workspace-escape-via-misleading-permission-prompt/"]}]
exploit_sources: []
---

# Claude Code VS Code extension's permission prompt hides where a symlink really points, so you can approve file access outside the project without knowing (UltraStrike, Anthropic won't fix)

Link for people: https://infrastack.ai/live/TECH-202611-sfuqeq (this .md is for agents)

UltraStrike (Carl Pearson, 2026-11-11) found that Anthropic's Claude Code extension for VS Code (anthropic.claude-code) asks for approval when the agent reads or writes through a symlink that leads outside the workspace, but the prompt shows only the in-workspace path (e.g. ./helpdocs/test.txt), not the real target. A user who approves may be letting the agent read or write files elsewhere, such as SSH keys in ~/.ssh. An agent under prompt injection, or a malicious symlink pushed to a shared repo by a compromised teammate account, can use this. The Claude Code CLI shows the real target and warns, after a silent fix following Adversa AI's May 2026 report; the VS Code extension does not. Reported to Anthropic on 2026-10-22; Anthropic closed it as not a vulnerability. Still unpatched in extension 2.1.322. Proof of concept only; no attacks reported. No CVE.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vscode:Claude Code for VS Code affected <= 2.1.322 fixed no fixed version listed

## How to check

- Find developers using the Claude Code extension for VS Code (anthropic.claude-code); 2.1.322 is confirmed affected, no fixed version.
- Look for symlinks in repos that point outside the repo: find . -type l -exec realpath {} \; and compare against the workspace path.
- Watch for new or renamed symlinks arriving in repo syncs or commits.

## Fix

- Before approving a file permission prompt in the VS Code extension, run realpath <path shown in the prompt> in a terminal and deny if it resolves outside the workspace.
- Prefer the Claude Code CLI, which shows the real symlink target and warns.
- Review commits that add symlinks in shared repos; open untrusted repos in a container or VM without SSH keys or cloud credentials.

## Timeline

- 2026-11-15T13:06:43+00:00 analyst https://ultrastrike.io/2026/11/claude-code-vscode-plugin-workspace-escape-via-misleading-permission-prompt/

## Documents

- [describes] @_r_netsec: Claude Code VSCode Plugin: Workspace Escape Via Misleading Permission Prompt htt https://x.com/_r_netsec/status/2121944244982292704
- [describes] Claude Code VSCode Plugin: Workspace Escape Via Misleading Permission Prompt - UltraStrike Cybersecurity https://ultrastrike.io/2026/11/claude-code-vscode-plugin-workspace-escape-via-misleading-permission-prompt/

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_