Patched Claude Code Flaws Allowed API Key Theft and Code Execution Before Trust Prompt

·1 views

Two security vulnerabilities, CVE-2026-21852 and CVE-2025-59536, were discovered in Anthropic's Claude Code CLI tool affecting versions prior to 2.0.65. The flaws stemmed from an order-of-operations defect in which the CLI merged project-level configuration files before presenting users with a trust confirmation prompt. This pre-trust execution window allowed a malicious repository to silently redirect API requests to an attacker-controlled server, exposing the developer's Anthropic API key in plaintext. Beyond credential theft, the same window enabled attackers to embed malicious lifecycle hooks in repository config files, triggering arbitrary code execution on the developer's machine at session start. The vulnerabilities were addressed in version 2.0.65, which enforces directory trust evaluation before any project-level configuration is loaded or executed.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Google Genkit Treats AI Prompts as Reviewable Code in TypeScript Workflows

Google's Genkit framework, tested against version 1.42.0 in September 2026, allows TypeScript developers to manage AI prompts as structured, version-controlled artifacts rather than embedded strings. Its Dotprompt format stores model configuration, input/output schemas, and templates in dedicated files, making changes trackable via Git and iterable through a Developer UI. Genkit flows wrap prompt execution with validated inputs, Zod-enforced output parsing, and trace identity, ensuring business logic such as price-drop rules runs independently of the language model. A separate context object lets sensitive data like auth tokens and tenant IDs pass through flows and tools without being exposed inside the prompt itself. The framework does not guarantee reliability automatically, but it makes critical boundaries between prompt, logic, and data visible and reviewable.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

LayerByte Releases Netcalc, a C++ IPv4/CIDR Subnet Calculator for Students

A developer under the handle LayerByte has released Netcalc, an open-source command-line tool designed to help students practice IPv4 and CIDR subnet calculations. The project is part of a broader collection of educational cybersecurity tools focused on defensive security concepts. Written in C++ and licensed under MIT, Netcalc is intentionally scoped to a single concept to keep the code readable and beginner-friendly. The tool includes input validation and error handling, and explicitly excludes any offensive capabilities such as exploitation or brute forcing. The source code is publicly available on GitHub, and the developer is welcoming feedback aimed at keeping the project safe and educationally useful.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Fileprobe: Open-Source Tool Helps Beginners Understand File Signatures and Metadata

A developer has released Fileprobe, a free, open-source educational cybersecurity tool built in C++ under the MIT license. The tool inspects binary file headers and metadata to help beginners understand why file extensions alone cannot reliably identify a file's true type. Fileprobe is part of the LayerByte collection of defensive security projects, each designed to focus on a single, clearly defined concept. The tool is intended strictly for school use, accepting only local or authorized input, and explicitly avoids any malicious functionality such as exploitation or credential theft. The project is publicly available on GitHub, and the developer is welcoming feedback aimed at keeping it safe and educationally useful.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

LayerByte Releases Entropyx, an Open-Source File Entropy Tool for Security Students

A developer under the handle LayerByte has released Entropyx, a free, open-source file entropy calculator designed exclusively for educational defensive security purposes. The C++ tool helps students understand static file analysis by comparing ordinary files against unusual binary samples using entropy as a key concept. Built with beginner readability in mind, it features clear validation, error handling, and intentionally excludes any offensive capabilities such as exploitation or malware behavior. The project is licensed under MIT and hosted publicly on GitHub as part of LayerByte's broader collection of focused, single-concept cybersecurity learning tools. The developer has invited community feedback, particularly suggestions that keep the project safe and suitable for classroom use.

0 comments Read more at DEV Community