interesting · Research — privilege
A workspace writer can redirect an approved Claude Code edit outside the project through a symlink race.
Affects
Claude Code, Anthropic's local coding-agent command-line application.
The checked path can be atomically replaced before write-time resolution, causing Claude Code to modify an attacker-selected file with the session user’s authority.
Detail and 1 source
The boundary failure is real but requires an adversarial concurrent workspace writer to win the race.