Critical Vulnerability in Claude Code Emerges Days After Source Leak

Anthropics Cloud Code is in the news again, and not for the best reasons.

Within days of each other, Anthropic first leaked the source code to Cloud Code,

and then a critical vulnerability was found by Adversa AI.

Cloud Code leak

On March 31, 2026, Anthropic mistakenly included a debugging JavaScript source map for

Cloud Code version 2.1.88 to NPM.

Within hours, researcher Chaufe and show discovered the source map and posted a link on X,

kicking off a global rush to examine deabfuscated Cloud Code's code.

Sigrid Jean, a 25-year-old student at the University of British Columbia,

worked with Yechan Hio to reconstruct the Cloud Code.

It took two humans, ten open claws, a MacBook Pro laptop, and a few hours to recreate

the popular AI agent's source code and share it with the world.

Reports Yahoo, proving that what goes up on the internet does not come down off the internet.

The result now persists on the internet, comprising 512,000 lines of TypeScript in 1900 files.

It is awkward but not catastrophic for Anthropic.

While the Cloud Code leak does present real risk, it is not the same as model weights,

training data or customer data being compromised.

What was exposed is something more like an operational blueprint

of how the current version of Cloud Code is designed to work.

Explains Melissa Bischoping, senior director of security and product design research at TANIUM.

The key is that researchers can see how Cloud Code is meant to work but cannot recreate it

because the leak does not include the Cloud model weights, the training data, customer data,

APIs or credentials. It is not a foolproof roadmap to exploitation,

but it is meaningful insight into how the tool handles inputs, enforces permissions and

resists abuse. Continues Bischoping. Another layer of risk from this leak is that adversaries may

use the blueprint to build lookalikes that appear and behave like Cloud Code on the surface,

but install malware or harvest credentials and data. She adds,

awkward and embarrassing for Anthropic, but not directly harmful to Cloud Code.

Vulnerability in Cloud Code. But a genuine and critical vulnerability has now been discovered

in Cloud Code proper by Adversa AI Red Team. Cloud Code is a 519-000-plus-line TypeScript application

that allows developers to interact with Cloud directly from the command line.

It can edit files, execute shell commands, search code bases, manage git workflows,

and orchestrate complex multi-step development tasks. Reports at Versa.

Never allow curl or git, prevent data exfiltration, but auto-allow and PM and git commands,

common development tools. That sounds correct and reasonable. The flaw, however, is that the deny

rules can be bypassed. The permission system is the primary security boundary between the AI

agent and the developer's system. Reports at Versa. When it fails silently, the developer has no

safety net. The problem stems from Anthropic's desire for improved performance following the

discovery of a performance issue. Complex compound commands cause the UI to freeze. Anthropic

fix this by capping analysis at 50 subcommands with a fall back to a generic ask prompt for anything

else. The code comments states, 50 is generous. Legitimate user commands don't split that wide.

Above the cap we fall back to ask, safe default. We can't prove safety, so we prompt.

The flaw discovered by at Versa is that this process can be manipulated. Anthropic's assumption

doesn't account for AI-generated commands from prompt injection, where a malicious claw.md

file instructs the AI to generate a 50 plus subcommand pipeline that looks like a legitimate

build process. If this is done, behavior asks forward slash forward slash not deny occurs

immediately. Deny rules, security validators, command injection detection, all skipped.

Rights of Versa. The 51st command reverts to ask is required, but the user gets no indication

that all deny rules have been ignored. At Versa ones that a motivated attacker could embed real

looking build steps in a malicious repository's claw.md. It would look routine, but no

per subcommand analysis runs at all when the count exceeds 50. This could allow the attacker to

exfiltrate SSH private keys, AWS credentials, GitHub tokens, and PM tokens or END secrets.

It could lead to credential theft at scale, supply chain compromise,

cloud infrastructure breach, and CI slash CD pipeline poisoning.

During testing, Claude's LLM safety layer independently caught some obviously malicious

payloads and refused to execute them. This is good defense and depth. Rights of Versa.

However, the permission system vulnerability exists regardless of the LLM layer. It is a bug in

the security policy enforcement code. A sufficiently crafted prompt injection that appears as

legitimate build instructions could bypass the LLM layer two.