The main Claude Code security risks come from what the agent is allowed to touch: your files, your shell, the network, and every MCP server it connects to. Prompt injection hidden in content it reads can steer those abilities, project files in a cloned repository can change its settings, and permissive modes can let actions run without anyone approving them. None of this means Claude Code is unsafe to use. It means the defaults and settings matter, and Anthropic documents controls for each risk, from permission rules to a sandbox to organization-wide managed settings.
One note on names: this article is about the Claude Code agent itself, not Claude Code Security, Anthropic's separate tool for finding vulnerabilities in code.
What Claude Code can do on a developer machine
Claude Code is an agent that runs in a terminal, an IDE or the desktop app. It reads and edits files, runs shell commands, fetches web pages, and calls tools from MCP servers. It can also run hooks, which are shell commands triggered by events such as a tool call, and load plugins that bundle commands, agents and servers. Settings that control all of this live at several levels: the user's own settings, a project's .claude/settings.json, a local file that is not committed, and managed settings deployed by an administrator.
Each of those abilities is useful, and each one is a path an attacker can try to use. A security review of Claude Code is mostly a review of which abilities are on, for which folders, and who can change them.
Prompt injection through content Claude Code reads
Prompt injection is text written to look like instructions, placed where the agent will read it: a web page, a code comment, a README, an issue, or a tool response. If the agent treats that text as a request, it may run a command or send data the user never asked for. Anthropic's security documentation lists the safeguards: in Manual mode, sensitive operations need approval; commands that fetch from the web such as curl and wget are not auto-approved by default; most web fetches go through a separate model call so Claude receives a summary rather than the raw page; and commands Claude Code cannot fully analyze still prompt.
The same page is direct about limits: no system is completely immune. Anthropic's advice for untrusted content is to review commands before approving, avoid piping untrusted content straight to Claude, and use virtual machines when working with external services.
MCP servers and project files are Claude Code security risks too
MCP servers add tools, and every tool is something the agent can be talked into using. Servers can be configured at user, local and project level, through claude.ai connectors, and through plugins. Anthropic's documentation notes that reviewing a repository's .mcp.json therefore does not show every server a session can load, and that Anthropic reviews directory connectors against listing criteria but does not security-audit any MCP server. Our guide to how to find MCP servers on developer machines lists where each of these files lives.
Project files deserve special attention because they arrive with git clone. Claude Code shows a workspace trust dialog the first time it starts in a folder, and a separate approval for servers in a project's .mcp.json. Sessions run with -p show neither prompt, so scripts and CI jobs load whatever the repository defines.
Documented Claude Code vulnerabilities
Check Point Research reported three flaws in this area, all fixed, as covered by The Register. First, hooks defined in a repository's .claude/settings.json could run shell commands on a collaborator's machine without explicit approval; Anthropic published advisory GHSA-ph6w-f82w-28w6 in August 2025. Second, repository settings could get around the approval prompt for .mcp.json servers so that commands ran before the trust dialog. That is CVE-2025-59536, rated 8.8 (high) in NVD, affecting versions before 1.0.111. Third, a project could override the ANTHROPIC_BASE_URL setting to route traffic through an attacker's server and expose the developer's API key, tracked as CVE-2026-21852 and fixed in version 2.0.65.
Two habits follow from these cases. Before accepting the trust dialog for a repository you did not write, read its .claude/settings.json and .mcp.json for hooks, server commands and environment overrides, the same way you would read a new build script. And keep Claude Code on automatic updates, or update promptly, because each of these was fixed in a release rather than by a setting.
The pattern is the same in all three: configuration files that look passive could make the agent act before a person decided anything. Users on auto-update received the fixes automatically. Anyone who pins versions or installs manually should check they are current.
Permission modes and auto-approval
A permission mode decides what runs without asking. Manual mode, the default, runs reads freely and asks before most edits, shell commands and network actions. acceptEdits also runs file edits and common filesystem commands inside the working directory. plan lets Claude research and propose but not edit until you approve. auto hands approval to a separate classifier model that blocks actions it judges risky, while explicit ask rules still prompt. dontAsk denies anything that would prompt, which suits CI. bypassPermissions runs everything without prompts.
Anthropic's documentation says bypassPermissions offers no protection against prompt injection and should be used only in isolated environments such as containers or virtual machines without internet access. Administrators can block it with permissions.disableBypassPermissionsMode, remove auto mode with permissions.disableAutoMode, and set the starting mode with permissions.defaultMode.
Secrets and the working directory boundary
In Manual mode, Claude Code asks before its file tools read or write outside the folder it started in. Anthropic notes that this boundary is a permission prompt, not an operating system control: a Bash command you approve can still write anywhere your user account can. Secrets in .env files, SSH keys and cloud credentials sit inside that reach. Claude Code stores its own API keys in the macOS Keychain where available, but it cannot protect secrets that other tools leave in plain files. Deny rules for sensitive paths and the sandbox described below close most of that gap. Keep long-lived cloud keys out of repositories the agent works in, and prefer short-lived tokens scoped to the task.
Controls that reduce Claude Code security risks
The Bash sandbox is the strongest single control. It isolates commands at the operating system level, using Seatbelt on macOS and bubblewrap on Linux, so they can only touch approved folders and reach approved domains. Anthropic reports that sandboxing cut permission prompts by 84% in its internal use, which makes it practical to leave on. Turn it on with /sandbox.
For teams, managed settings are the policy layer. Deployed as managed-settings.json to /Library/Application Support/ClaudeCode/ on macOS, /etc/claude-code/ on Linux or C:\Program Files\ClaudeCode\ on Windows, they sit above every user and project setting. They can allow only approved MCP servers with allowedMcpServers and allowManagedMcpServersOnly, block servers with deniedMcpServers, accept only administrator hooks with allowManagedHooksOnly, and accept only administrator permission rules with allowManagedPermissionRulesOnly. Anthropic also recommends auditing permissions with /permissions and monitoring usage through OpenTelemetry metrics.
Policy only covers what you know is installed. The MCP security checklist gives the per-server review, and an inventory tells you which machines run Claude Code at all.
Two related reads: what the --dangerously-skip-permissions flag actually turns off, and how vibe coding security risks change when an agent ships code nobody reviews. For a similar review of another agent, see our notes on Windsurf security concerns.
Next step: map your Claude Code security risks
Claude Code security risks depend on which machines run it, in which modes, with which MCP servers. Start by finding out. Run a Discovery Scan to list every Claude Code install and the servers each one loads, with a risk score and the reason for each.