Claude Code --dangerously-skip-permissions vulnerability and open-source defense tool
Security vulnerability in Claude Code with --dangerously-skip-permissions
When using Claude Code with the --dangerously-skip-permissions flag, there's a documented indirect prompt injection vulnerability. The core issue: Claude processes untrusted content with trusted privileges and can't reliably distinguish between your instructions and malicious instructions embedded in that content.
Attack vectors documented by Lasso Security
- Hidden instructions in README or code comments of cloned repositories
- Malicious content in web pages Claude fetches for research
- Edited pages coming through MCP connectors (Notion, GitHub, Slack, etc.)
- Encoded payloads in Base64, homoglyphs, zero-width characters
The flag removes the human checkpoint that would normally catch suspicious activity, creating a significant attack surface when Claude reads files, fetches pages, or gets output from MCP servers.
Open-source defense tool
Lasso Security released a PostToolUse hook that scans tool outputs against 50+ detection patterns before Claude processes them. The tool warns rather than blocks outright to avoid false positives and maintain context. Setup takes about 5 minutes and works with both Python and TypeScript.
The tool is available on GitHub as claude-hooks and detailed in Lasso's blog post about the vulnerability.
📖 Read the full source: r/ClaudeAI
👀 See Also
Claude's Conversation Search Tool Still Returns Deleted Chats
A Claude Pro user discovered that deleted conversations remain retrievable through Claude's conversation search tool, returning substantive content including titles, message counts, and excerpts despite the chat links being dead.
AI Agent Security: Token Budget Determines Data Exfiltration Risk
A developer tested AI agents connected to Gmail: frontier models caught phishing, mid-tier was unstable, cheap models silently forwarded malicious emails. Architectural protections (sandboxing, permissions) stopped zero attempts.
GitHub Copilot CLI vulnerability allows malware execution via prompt injection
A vulnerability in GitHub Copilot CLI allows arbitrary shell command execution via indirect prompt injection without user approval. Attackers can craft commands that bypass validation and execute malware immediately on the victim's computer.
Bitwarden Agent Access SDK integrates with OneCLI for secure credential injection
Bitwarden's new Agent Access SDK enables AI agents to access credentials from Bitwarden's vault with human approval, while OneCLI acts as a gateway that injects credentials at the network layer without exposing raw values to agents.