Claude Code Security Advisory: CVE-2026-33068 Workspace Trust Bypass
Security Vulnerability in Claude Code
A security advisory has been issued for Claude Code users regarding CVE-2026-33068, a vulnerability with CVSS score 7.7 (HIGH). The issue affects Claude Code versions prior to 2.1.53.
Technical Details
The vulnerability allows malicious repositories to bypass the workspace trust confirmation dialog. Claude Code includes a legitimate feature called bypassPermissions in .claude/settings.json that lets users pre-approve specific operations in trusted workspaces.
The bug was in the order of operations: settings from the repository's .claude/settings.json were loaded before the workspace trust dialog was shown to the user. This means a cloned repository could include a settings file that grants itself elevated permissions before the user has a chance to review it.
Important nuance: bypassPermissions is a documented, intentional feature. The vulnerability is not in the feature itself but in the loading sequence.
What Users Should Do
- Run
claude --versionto confirm you are on 2.1.53 or later - Before opening any unfamiliar repository with Claude Code, check whether it contains a
.claude/settings.jsonfile and review its contents - If you have been working with repositories from untrusted sources on earlier versions, consider whether any unexpected operations were performed
Fix
Anthropic fixed this vulnerability in version 2.1.53 by reordering the loading sequence. The full advisory with technical details is available at https://raxe.ai/labs/advisories/RAXE-2026-040.
📖 Read the full source: r/ClaudeAI
👀 See Also
Coldkey: Post-Quantum Age Key Generation and Paper Backup Tool
Coldkey generates post-quantum age keys (ML-KEM-768 + X25519) and produces single-page printable HTML backups with QR codes for offline storage.
MCPwner AI Pentesting Tool Finds Multiple 0-Day Vulnerabilities in OpenClaw
MCPwner, an MCP server that orchestrates AI agents for automated penetration testing, identified several critical 0-day vulnerabilities in OpenClaw including environment variable injection, permission bypass, and information disclosure flaws that standard scanners missed.
Anthropic reveals industrial-scale Claude AI data extraction by Chinese labs
Anthropic confirmed Chinese AI labs used over 24,000 fraudulent accounts to scrape 16 million exchanges from Claude, extracting safety guardrails and logic structures for military and surveillance systems.
Claude Cage: Docker Sandbox for Claude Code Security
A developer created a Docker container called Claude Cage that isolates Claude Code to a single workspace folder, preventing access to SSH keys, AWS credentials, and personal files. The setup includes security rules and takes about 2 minutes with Docker installed.